18.2 Operation, Proof Testing, Demands, and Bypasses
Key Takeaways
- ISA/IEC 61511-1:2018 Clause 16 requires operating and maintenance procedures covering inspection, proof testing, demand recording, failure reporting, and bypass management so the claimed SIL remains valid.
- Automatic diagnostics convert some dangerous failures into dangerous-detected failures; proof tests are intended to reveal remaining dangerous-undetected failures, and proof-test coverage is rarely 100%.
- For a simplified 1oo1 undetected term, PFDavg ≈ λ_DU × T_proof / 2; extending T_proof from 1 year to 3 years at λ_DU = 2.0×10⁻⁶/h raises PFDavg from about 0.0088 (SIL 2 band) to about 0.026 (SIL 1 band) if nothing else changes.
- Successful and failed demands must both be recorded; a successful demand still counts toward the assumed demand rate, and a failed demand is a dangerous failure that escaped diagnostics and prior proof tests.
- Bypasses require authorization, time limits, and compensating measures; partial-stroke tests increase diagnostic coverage of some valve stuck failures but do not by themselves prove full-travel dangerous failure modes.
Why operations keep or lose the SIL claim
NCEES PE Control Systems 2027 item 5.F tests operation and maintenance: inspection, testing, demands, failures and failure rates, causes, bypass management, and degradation. ISA/IEC 61511-1:2018 Clause 16 is the matching lifecycle phase. SIL verification done at design is a prediction. The prediction stays valid only if the plant actually inspects, proof-tests, records demands, restores failures within the assumed mean time to restoration, and manages bypasses. A SIF that was SIL 2 on paper is not SIL 2 in service if proof tests are skipped, diagnostic alarms are shelved, or a bypass is left in.
Inspection versus proof testing versus automatic diagnostics
Inspection looks for visible or environmental degradation: corrosion, leaking packing, heat-traced impulse lines that froze, missing bolting, water in a junction box, a blocked flame-arrestor on a gas detector. Inspection does not stroke the valve or inject a trip.
Automatic diagnostics run while the SIF is in service. Examples: transmitter out-of-range, NAMUR NE 43 failure current, solenoid-circuit continuity, discrepancy in 2oo3 voting, partial-stroke signature on a smart positioner. Failures they reveal are dangerous detected (DD). In PFDavg they sit behind mean time to restoration, not behind the full proof-test interval, provided the diagnostic is enabled, alarmed, and repaired.
A proof test is a planned, documented functional test intended to reveal dangerous undetected (DU) failures so the channel can be restored. Proof-test coverage (often written C_PT) is the fraction of DU failures the procedure actually finds. Coverage is not 100% if the test injects a signal at the transmitter terminals and never proves the process tap is open, or if it trips the logic but does not confirm the valve reaches the safe state. Residual DU failures after an imperfect proof test accumulate over useful life or overhaul interval, not only over T_proof.
Failure rates, causes, and degradation
Random hardware failures are quantified as λ_DD and λ_DU (and safe-failure counterparts). Systematic failures are not “averaged away” by a λ: a wrong setpoint after an undocumented change, a bypass key left in, a proof-test procedure that cannot be performed, firmware loaded on the wrong revision. Clause 16 expects both classes to be investigated.
Degradation is the slow movement from the as-validated condition toward higher DU failure rates: packing that sticks after months of no travel, impulse-line plugging, diagnostic coverage that was 90% in the certificate but is 0% because the alarm is suppressed, instrument air that no longer meets the dew-point assumption. Demand-mode SIL claims assume the failure rates used in verification; if degradation is ignored, PFDavg is optimistic.
| Failure mode (example) | Typically detected by automatic diagnostics? | Revealed by a complete proof test? | Remains undetected if both are weak |
|---|---|---|---|
| Transmitter output stuck in range | No, unless comparison/voting or process-correlation diagnostics exist | Yes, if the test drives the actual process variable or a traced overlapping simulation | Yes — classic DU; plugged tap with a healthy 4–20 mA signal |
| Transmitter out of range / NE 43 failure current | Yes, if the diagnostic is enabled and alarmed | Yes | Unlikely if diagnostics are in service |
| Logic-solver I/O channel fault | Often yes (I/O diagnostics) | Yes, if the test exercises that channel | Possible if diagnostics are disabled or the test uses a different channel |
| Solenoid coil open (de-energize-to-trip) | Often yes (continuity / output readback) | Yes | Unlikely if the circuit is monitored |
| Valve stuck off the seat (will not complete stroke) | Partial stroke may catch some stiction | Full-stroke proof test, timed to the safe state | Yes if only partial stroke is used and full travel is never proven |
| Valve leaks through when “closed” | No | Only if the proof test includes leak tightness / downstream isolation | Yes — tightness is a different dangerous mode from “did it move 15%” |
| Bypass left active | Only if bypass is alarmed and not shelved | Inspection of bypass status during the test | Yes — systematic, not a λ_DU term |
Recording demands: successful versus failed
Clause 16 requires recording demands and failures. A successful demand means the hazardous condition occurred (or a real process demand was placed on the SIF) and the SIF achieved the safe state. Log it. It still counts toward the demand rate used in LOPA and in the low-demand versus high-demand mode decision. If the SRS and LOPA assumed one demand in ten years and operations see three demands in two years, the SIL verification and even the demand mode may be invalid.
A failed demand means the SIF was called and did not achieve the safe state in time. That is a dangerous failure that escaped diagnostics and prior proof tests. Treat it as a functional-safety incident: restore the process, investigate cause (random hardware versus systematic), repair, re-validate the affected portion, and feed the failure into the reliability dataset. Do not discard successful trips from the log to “keep the assumed demand rate low.”
Bypass management and compensating measures
Bypassing a SIF, or a channel of a SIF, removes that risk reduction for as long as the bypass is in. ISA/IEC 61511-1:2018 requires written procedures, authorization, logging, and compensating measures that keep risk acceptable while the function is unavailable. Typical measures: continuous occupancy and a specified operator action, a temporary independent trip, reduced throughput, or taking the equipment out of service. If the compensating measure is an operator responding to an alarm, that alarm and procedure need MOC-level discipline and testing; it is not a casual radio call.
Time limits belong in the SRS or the operating procedure. Exceeding the limit is a modification, not an extension of the same bypass. A bypass that becomes the normal way to run the unit is a design change and a LOPA change. Forgotten bypasses are a leading systematic cause of lost protection.
When a diagnostic or proof test finds a dangerous fault, the same rule applies until repair: compensating measures or a specified action to the safe state, within the restoration time used in the PFDavg model.
Partial stroke versus full stroke
Partial-stroke testing (PST) typically moves a shutdown valve a limited travel (often on the order of 10–20%) and looks at signature, pressure, or limit-switch response. PST can raise diagnostic coverage of some stuck-shaft and stiction modes without shutting the process down. It does not prove full travel, closing time against process safety time, or seat tightness. Full-stroke proof tests remain necessary for the dangerous modes PST cannot see, unless a documented failure-mode analysis shows equivalent coverage and the SIL verification uses that coverage. Credit for PST is an engineering change to λ_DD/λ_DU and possibly to T_proof, not a verbal “we wiggle it quarterly.”
Worked example: extending T_proof without recalculating PFD
SIF-310 is claimed SIL 2 in low demand. A simplified 1oo1 undetected term (the sensitivity model the exam likes, not a full IEC 61508 verification) uses λ_DU = 2.0×10⁻⁶ /h for the dominating channel and T_proof = 1 year = 8,760 h:
PFDavg ≈ λ_DU × T_proof / 2 = (2.0×10⁻⁶)(8,760)/2 = 0.00876
That sits in the SIL 2 low-demand band (0.001 to 0.01). Operations wants to extend proof testing to 3 years because a full stroke requires a unit outage. New T_proof = 26,280 h, nothing else recalculated:
PFDavg ≈ (2.0×10⁻⁶)(26,280)/2 = 0.0263
0.0263 is in the SIL 1 band (0.01 to 0.1). The SIL 2 claim is lost even before adding DD restoration, common cause, and C_PT < 1. If proof-test coverage is only 70%, 30% of DU failures never reset at T_proof and grow over useful life, making the real PFD worse still. Lawful paths: keep T_proof = 1 year, add diagnostics/PST with a revised verification, change architecture, or reduce the SIL claim and revisit LOPA. Extending the calendar without recalculating PFDavg is not a path.
How do automatic diagnostics and proof tests differ in covering dangerous failures of a SIF?
Operations extends a SIF’s proof-test interval from 1 year to 3 years without recalculating PFDavg. Using the simplified 1oo1 undetected term PFDavg ≈ λ_DU × T_proof / 2, what is the integrity concern?
Which statement correctly describes bypasses and partial-stroke testing under ISA/IEC 61511-1:2018 operations practice?