SIS Testing Questions

Question Theme: What are the differences between a routine transmitter calibration check and a typical "Partial" proof test of an SIS temperature transmitter?

Note - for sake of this question, assume the instrument is a 3144P 4-20mA HART temperature transmitter with the following:

    • Assume Single RTD sensor configuration
    • Assume it is being used as part of a SIL-1 safety instrumented function (SIF)
    • Assume control system cannot directly read HART data

Q1 - What are differences in the procedures?

Q2 - What likely errors does one find that the other does not? 

Q3 - Which would have priority if a manager had to choose to delay or skip one of the two due to manpower limitations or other issues? 

Q4 - Which provides the greatest amount of overall risk reduction? 

See answers below image. 
Texas City Disaster (2005)

ANSWERS:

A1 - What are differences in the procedures?

The Partial proof test procedure (per Rosemount 3144P Manual is summarized as follows: 
1. Bypass the safety PLC or take other appropriate action to avoid a false trip.
2. Send a HART command to the transmitter to go to high alarm current output and verify that the analog current reaches that value. 
3. Send a HART command to the transmitter to go to the low alarm current output and verify that the analog current reaches that value. 
4. Use the HART communicator to view detailed device status to ensure no alarms or warnings are present in the transmitter.
5. Perform reasonability check on the sensor value(s) versus an independent estimate (i.e. from direct monitoring of BPCS value) to show current reading is good.
6. Restore the loop to full operation.
7. Remove the bypass from the safety PLC or otherwise restore to normal operation.
A typical transmitter calibration procedure may vary, but typically consists of the following: 
1. Bypass the controller / to prevent false trip during testing
2. Simulate applicable range of inputs (typically 3, 5, or 9-point checks) and verify that transmitter PV and output and/or controller/HMI PV is within tolerance of simulated signal. 
3. Remove the bypass and restore normal operation. 
So the key difference is that the CALIBRATION CHECK is only testing the accuracy of the signal, whereas the Partial Proof Test is checking the overall operation of the instrument from sensor to the controller data, thereby capturing a much broader range of possible errors. 
By going to the HIGH fault current and ensuring the signal current is within expected tolerance, it tests for compliance voltage problems such as low loop power supply voltage or increased wiring resistance and other possible failures of the overall system. 
By testing the LOW fault current and ensuring the signal current is within expected tolerance, it tests for possible leakage currents in the loop and other possible problems with the overall system. 
For best overall assurance a plant procedure may look at the controller or HMI data instead of the 4-20mA signal in order to verify proper operation of additional components of the overall system such as controller analog input A/D card, scaling, etc. 
The reasonability check of step 5 in the SIS partial proof test procedure ensures that the value is within tolerance at the applicable point. While this does not verify the full range, it dramatically increases confidence in the signal since very few 'calibration' type failures would cause notable errors at one point of the range without impacting other points. For best overall assurance the reasonability check should be performed in the normal operating range away from any endpoints, saturation levels, bridle tap levels, etc.. 

A2 - What likely errors does one find that the other does not? 

SIS procedures are based on real statistics of failure rates and types of failures. SIS tests are specifically intended to identify dangerous undetected failures (meaning failures that could occur without being noticed and which could result in inaction by the safety function). 
Statistically, most loop failures in properly installed instruments are due to problems such as power supply issues, excess loop impedance, bad wiring, partial shorts in the signal path or transmitter housings, etc. 
The reasonability check does an adequate job of confirming no instrument drift has occurred. Additionally, most SIS systems would also have a backup process control reading to compare to with a deviation alert if the two differ notably. Therefore, by testing the Low and High fault current tests and doing a reasonability test, you are effectively testing the vast majority of likely failures that could result in worst case scenarios and will still catch most of the minor failures. 
Additionally, by testing outside the normal 0-100% range of the transmitter, by going to the High and Low fault current points (which are well beyond the saturation range of the transmitter let alone the normal 0-100% range) we verify there are no problems that are on the edge of causing a problem and add assurance that the system will operate reliably. 

A3 - Which would have priority if a manager had to choose to delay or skip one of the two due to manpower limitations or other issues? 

IEC 61511 (and ISA 84) Safety Instrumented Systems or SIS programs are well designed standards that truly boost process safety and are essential to ensuring that risks are adequately mitigated.

If a calibration drifted substantially, it would likely be captured by the reasonability check of the SIS partial proof procedure and/or from other comparisons such as deviation alerts - but many of the potential errors that could prevent a safety instrumented function from performing it's required action would not be discovered during typical calibration test procedures. 

So - unless there are serious engineering advantages or possible legal, regulatory, or other safety reasons to performing a routine calibration check, the SIS procedure should typically rank at the top of the priority list for instrumentation work. 

A4 - Which provides the greatest amount of overall risk reduction?

The SIS procedures are methodically established, and based on the extensive standards of IEC 61511 (or ISA 84 in USA). These standards include all aspects of the engineering safety lifecycle and do a fantastic job of ensuring that the layers of protection that need to meet certain reliability levels to achieve desired risk reduction factors will do so. The SIS program is one of the most important and most valuable programs and most important maintenance that Instrument Technicians perform. An SIS partial proof test provides dramatically more risk reduction than a routine calibration check. 

Note: 

There is much more to the SIS maintenance topic.. We cover all of the most critical concepts and issues in our Hands-on SIS for Technicians courses.
Many techs are not trained on these issues and fail to recognize the value or purpose of SIS programs or testing and thereby fail to achieve the needed risk reductions.
Along with good procedures, good standards, and good engineering practices, the technicians MUST be properly trained to understand the basics of SIS programs from the creation of HAZOPS and LOPA's through demand tracking and reliability performance tracking and proper testing - or even the best SIS programs will fail to achieve objectives.  
Our SIS training courses are designed for personnel such as Technicians and Managers responsible for the implementation of SIS programs. We have found that the engineering intensive training fails to meet the needs of this group and results in minimal progress - so we build our SIS for Techs and Managers program to help fill the gap. 
Please let us know if you have questions, feedback, or input on this question and/or answers.

Mike Glass

About the author

Mike Glass

Mike Glass is an ISA Certified Automation Professional (CAP) and a Master Certified Control System Technician (CCST III). Mike has 38 years of experience in the I&C industry performing a mix of startups, field service and troubleshooting, controls integration and programming, tuning & optimization services, and general I&C consulting, as well as providing technical training and a variety of skills-related solutions to customers across North America.

Mike can be reached directly via [email protected] or by phone at (208) 715-1590.