Safety Instrumented Systems exist for one reason: to bring a process to a safe state before people get hurt, assets are lost, or the environment is damaged. Yet SIS failures continue to occur not because engineers don't understand the theory, but because the gap between knowing the standard and executing it correctly in the field is wider than most people admit.

The Buncefield explosion in the UK (2005), the Texas City refinery disaster (2005), and countless smaller events share a common thread: safety layers that should have worked did not. Proof tests were skipped or inadequate. Instrumentation diagnostics were ignored. Protection systems were poorly designed for the actual process hazard. IEC 61511 provides the framework, but it cannot compensate for poor engineering decisions in the field.

This article draws on the Emerson Process Management special report "Consider These Safety Instrumented System Best Practices", expands each topic substantially using IEC 61511 (2016 edition), IEC 61508, ISA TR84.00.02, API RP 521, CCPS guidance, and over a decade of hands-on SIS project experience from HAZOP and LOPA through FAT, commissioning, and operational maintenance.

The article is structured around three core pillars. Part 1 covers High Integrity Protection Systems (HIPS) for reactive processes when a pressure relief valve is not enough. Part 2 covers HART diagnostics in DeltaV SIS — what they mean, how to configure them, and the critical limits you must respect. Part 3 covers proof testing and lifecycle management the difference between a proof test that actually maintains your SIL and one that creates a false sense of security.

Twenty best practices are woven throughout. Each one is a real engineering decision with real consequences if you get it wrong.

🔥
Loss of Containment
Fire, explosion, toxic release — the direct result of SIS failure on demand.
📉
Production Loss
Spurious trips or failed bypasses cost millions per unplanned shutdown.
⚖️
Regulatory Penalty
IEC 61511 compliance failures trigger process safety audits, fines, and shutdowns.

Table of Contents

Part One

High Integrity Protection Systems (HIPS) for Reactive Processes

An uncontrolled chemical reaction can generate pressure far faster than any relief valve can respond. When that happens, the vessel ruptures. If the contents are flammable or toxic, the consequences are catastrophic. This is the problem space that HIPS was designed to address.

Understand Exactly What HIPS Is and What It Is Not

A High Integrity Protection System (HIPS) is a Safety Instrumented System (SIS) specifically designed to prevent vessel overpressure typically as a replacement for, or supplement to, a pressure relief valve (PRV). It consists of the full instrument loop: field sensors → logic solver → final elements, including all support utilities (power, air/gas supply, communications).

HIPS is not a standalone device. It is not just a pressure transmitter and a shutdown valve. Every element in the loop must be designed, verified, and maintained as part of the SIF. Forget one element; the air supply, the solenoid valve, the power feed and your SIL calculation is wrong.

⚡
IEC 61511 Clause 10 & 11 Reminder

The SRS must define all elements of the SIF including support systems. A HIPS with a non-redundant, single-point-of-failure air supply cannot claim SIL-3 integrity.

Know When a PRV Is Not Enough And When HIPS Must Be Considered

Pressure relief valves are mechanical devices. They open when pressure reaches a set point. Simple, proven, and reliable under normal overpressure scenarios. But reactive processes break that model. Dr. Angela Summers of SIS-TECH identifies the specific conditions where a PRV becomes inadequate or dangerous:

  • Runaway reaction generates pressure at an uncontrollable rate; a PRV large enough to handle the flow rate is physically impossible to install.
  • Reaction occurs in a localized hot spot, propagating pressure faster than the PRV can respond.
  • Temperature exceeds thermal decomposition thresholds, risking internal detonation.
  • Reaction products partially or fully block the PRV inlet; polymer deposits, solids, wax.
  • Polymerization continues as material is being relieved, plugging the lateral header.
Source: Emerson Process Management — Consider These SIS Best Practices; API RP 521
Attribute Pressure Relief Valve (PRV) HIPS
Protection MechanismPassive — opens at set pressureActive — detects condition, closes/opens final element
Response to Reactive RunawayInadequate — may require impractical vent sizeDesigned for fast response — configurable response time
Plugging RiskHigh with reactive/polymerizing fluidsNo contact with process fluid (typically)
SIL RequirementN/A — mechanical deviceSIL-2 minimum; SIL-3 common (majority of projects)
IEC 61511 ScopeNot in scopeFully within IEC 61511 lifecycle scope
Proof Test IntervalPer local inspection regulationDefined by SIL verification — typically 1–3 years
Failure ModeFails to open at set P; may open at higher PMore likely to fail completely if not maintained
Independent 3rd-Party ReviewNot mandatory (but recommended)Strongly recommended by ISA TR84 for SIL-3
Every HIPS Design Must Start with a Rigorous Hazard Analysis

You cannot design a HIPS from a P&ID alone. The design must be rooted in a structured, multidisciplinary hazard analysis. For reactive processes, this means:

  • HAZOP for systematic deviation review across all operating modes including startup, shutdown, and batch steps.
  • LOPA to establish the required risk reduction and determine the target SIL for each SIF.
  • Reactive chemicals screening: document all potential reaction paths, including low-probability multi-failure paths. If a reaction path exists, even through multiple failures, it must be assessed.
  • For batch processes: scrutinise every step for deviations: skipped steps, steps out of sequence, wrong recipe, wrong timing.
  • Consequence modelling for all overpressure scenarios: using API RP 521 and recognised consequence analysis tools.
⚠️
Common Design Mistake

Teams routinely design HIPS based on the "expected" reaction path only. Abnormal paths, unexpected catalyst contamination, temperature excursions during off-spec feeds are ignored. In real incidents, it is almost always the unexpected path that kills.

Write a Complete Safety Requirement Specification (SRS) for Every HIPS

IEC 61511 Clause 10 requires a Safety Requirement Specification before any SIS design begins. For HIPS, this is not optional paperwork; it is the engineering foundation. A proper HIPS SRS must include:

  • Functional description: What is the initiating condition, what process variable triggers the trip, what is the trip setpoint, what is the final element fail-safe state?
  • SIL target: Derived from LOPA, not assumed.
  • Response time requirement: Based on the rate of pressure escalation versus the HIPS response capability. This must be calculated, not estimated.
  • Voting logic: 1oo2, 2oo3, or other with justification from the SIL calculation.
  • Proof test interval: Specified in the SRS, justified by the SIL verification calculation.
  • Process connections: Separate taps required for redundant transmitters to avoid common cause failure.
  • Preemptive interlocks: If used, documented separately from the final HIPS action.
  • Support system requirements: Power, instrument air, communications; all must be specified.

Lesson Learned: On a refinery expansion project, the HIPS SRS was written after the P&ID was issued. The trip setpoint chosen was based on normal operating range, not worst-case reaction rate. During HAZOP review, the setpoint was found to be too high to prevent overpressure in a runaway scenario. The redesign cost six weeks of project schedule.

Target SIL-3 for HIPS — Here Is Why

The data published in CCPS "Guidelines for Process Equipment Reliability Data" shows that a single spring-operated PRV has a failure-to-open-on-demand probability of approximately 2.12 × 10⁻⁴ (mean value), with upper bounds reaching 7.98 × 10⁻⁴. Pilot-operated PRVs are worse: mean 4.15 × 10⁻³.

This data maps directly to SIL-2 and SIL-3 territory. More critically, the failure modes differ: a PRV that fails to open at the set pressure may still open at a higher pressure. A HIPS that fails is far more likely to fail completely; a dangerous detected or undetected failure that leaves the vessel with no protection at all.

Consequence: The majority of HIPS applications in refining and petrochemical carry a SIL-3 target. Where HIPS is the sole layer of protection against the overpressure event replacing both the PRV and process controls; independent third-party verification of the SIL claim is strongly recommended by ISA TR84.

Design the Architecture Correctly: Sensors, Logic Solver, Final Elements

Process Sensors

HIPS sensors typically measure pressure, temperature, and flow. Minimum requirement is 1oo2 or 2oo3 voting transmitters. Redundant inputs allow input diagnostics that significantly increase field input integrity. Separate process connections are mandatory — sharing a process tap between redundant transmitters is a common cause failure waiting to happen.

Logic Solver

Must comply with SIL-3 performance requirements per IEC 61508; high self-diagnostics, fault-tolerant, redundant signal paths and logic processing. Always configure as de-energise to trip. A logic solver that energises to trip will fail safe on a power loss only if it was designed that way; most weren't.

Final Elements

HIPS must use a minimum of dual final elements in 1oo2 configuration. Solenoids must be configured de-energise to trip, mounted as close to the valve actuator as possible to minimise transfer volume. Exhaust ports must be as large as possible to maximise actuation speed. Valve actuator must provide sufficient force to close under worst-case upset pressure conditions.

✅
Architecture Summary for SIL-3 HIPS

Sensors: 2oo3 with separate process taps, IEC 61508 SIL-3 certified transmitters.
Logic Solver: SIL-3 PES with full redundancy, DeltaV CSLS or equivalent.
Final Elements: Dual fail-closed block valves in 1oo2, solenoids de-energise to trip, dedicated air supply with adequate volume.

Response Time Must Be Calculated — Not Assumed

HIPS response time is the sum of: (1) time for the sensor to detect the abnormal condition, (2) logic solver scan rate and data processing time, and (3) final element closure or actuation time. Every component adds up. This total must be compared against the rate of pressure escalation for the hazardous scenario.

If the pressure can reach the vessel design pressure before the HIPS acts, the HIPS is useless. This calculation must be documented in the SRS and verified independently.

  • High-speed reactive processes may require response times under 500 milliseconds test this during FAT, not commissioning.
  • Valve actuator selection must include worst-case upset pressure in the closing force calculation; a standard spring return may not close against full process pressure.
  • Check: Does the damping setting on your transmitter, added to the SIS logic scan time and valve closure time, still meet the Process Safety Time?

Lesson Learned: On a polymerisation reactor project, the final element closure time was specified as 2 seconds in the SRS. During FAT, testing against simulated process pressure revealed the valve required 3.8 seconds. The SIL-3 calculation was invalid. A larger actuator spring pack and dedicated volume booster were required.

Part Two

HART Diagnostics in DeltaV SIS — What Matters and What Doesn't

HART diagnostics provide far more information about field device health than a 4–20 mA signal alone. When integrated correctly into the DeltaV SIS, they can convert Dangerous Undetected (DU) failures into Dangerous Detected (DD) failures improving diagnostic coverage, reducing PFDavg, and allowing longer proof test intervals. When integrated incorrectly, they create spurious trips, false confidence, or missed failure modes.

Most SIS vendors use HART multiplexers to strip the HART signal at the field termination assembly and pass it to a separate Asset Management System (AMS). The SIS logic never sees the HART data. DeltaV SIS is different: it can use HART diagnostics directly within the SIS logic, or pass them to the BPCS and AMS, or both. This capability has significant implications for SIL verification and proof test interval calculations.

Understand the Fundamental Rule: HART Is Diagnostic — Never Safety-Rated
🚨
Critical Engineering Boundary

HART is not a safety-rated platform. Never substitute a HART signal for a hardwired signal when that signal is being used to detect a hazardous condition with a SIL rating.

The most common example: valve position. The Fisher DVC6200/DVC6000 series positioner reports valve travel via the HART_FV parameter. This is useful for command disagree alarming and diagnostics. But if you need to detect that a valve is open in a hazardous condition for a SIL-rated function; you need a hardwired limit switch or position transmitter. HART valve position data cannot be used as the safety signal.

HART should be used exclusively for: device health monitoring, diagnostics, alarm generation, partial stroke test initiation and result verification, and extending proof test intervals by improving diagnostic coverage in SIL calculations. Nothing more.

Configure the HART_ERRORS Parameter — It Is Ignored by Default

This is one of the most commonly missed configuration steps in DeltaV SIS projects. After creating a HART-enabled channel on a CSLS (CHARM Smart Logic Solver) — either an analog input CHARM or a DVC output CHARM; engineers assume the HART diagnostics are active. They are not.

The HART_ERRORS parameter in DeltaV SIS is set to ignore all built-in status signals by default. You must explicitly enable each signal you want the SIS to act on. Configuration is done via DeltaV Explorer: drill into the HART-enabled channel and open the HART_ERRORS parameter properties.

For each built-in HART status signal, you must decide: should a fault here cause voting degradation (remove the transmitter from voting), generate an alarm only, or trip the associated valve? This decision must be documented in the SRS and justified in the SIL verification calculation.

⚙️
FAT Note

During FAT, it may be beneficial to temporarily disable device alerts to reduce alarm noise when real devices are not connected. Device alerts for HART devices do not require physical device presence to be programmed. Re-enable before SAT.

Know All Six Built-In HART Status Signals and What Each One Means

DeltaV SIS automatically reads the following built-in HART status signals from transmitters and the DVC6000/DVC6200 series positioner. Each has a specific engineering meaning, failure mode, and required response.

01 · PV Out of Limits

What it means: The transmitter is reporting a primary variable outside the 4–20 mA range.

Typical cause: Open or short circuit in transmitter wiring.

Recommended action: Trigger voting degradation. Remove transmitter from 2oo3 or 1oo2 logic. Alert maintenance immediately.

02 · Analog-Digital Mismatch

What it means: A difference exists between the analog 4–20 mA signal and the digital HART process variable.

Typical cause: Small ground loop in the home-run cable; intermittent device. Critical risk: A ground loop can prevent the trip limit from ever being reached, even under a real hazardous condition.

Recommended action: Configure to trip or alarm. Investigate immediately. Do not ignore.

03 · PV Output Saturated

What it means: Both analog and digital PV are beyond their limits and no longer represent the true process.

Critical engineering note: Set the CSLS faulty transmitter detection range equal to the device failure alarm setpoints (3.75 mA low / 21.75 mA high for Rosemount 3051S). If set within the saturation range (3.9–20.8 mA), spurious trips will occur even though the transmitter is still functioning correctly.

Recommended action: Voting degradation; flag for maintenance.

04 · PV Output Fixed

What it means: Analog and digital PV are held at a fixed value and will not respond to the process. Typically because a technician has placed the transmitter in calibration or maintenance mode.

Risk: If the transmitter stays fixed and nobody notices, the SIF cannot detect the hazardous condition.

Recommended action: Voting degradation; strict bypass management procedures required.

05 · Loss of Digital Communications

What it means: The HART digital signal is lost. The 4–20 mA analog signal may still be valid.

Important: Loss of HART comms will NOT trip a DVC6000 series positioner. If the 4–20 mA signal is still active, the valve continues to operate normally.

Recommended action: Generate maintenance alarm. Verify analog signal is intact. Investigate root cause before next test interval.

06 · Field Device Malfunction

What it means: The device has detected an internal hardware failure — memory, A/D converter, CPU, or other electronics fault.

Recommended action: This is a hard fault. Trigger immediate voting degradation. Replace device before the SIF is demanded. Do not leave a malfunctioning device in a voted configuration.

Source: Emerson Process Management — "Get the Most Out of Your HART SIS" · DeltaV SIS HART Capabilities White Paper
Use Voting Degradation Correctly — It Is a Double-Edged Tool

When a DeltaV SIS detects a bad transmitter via HART status signals, it can automatically degrade the voting — removing the failed device from the logic. A 2oo3 configuration degrades to 1oo2. A 1oo2 configuration degrades to 1oo1.

Original Voting After 1 Device Failure Availability Impact Safety Impact
2oo31oo2Improved (fewer spurious trips)Maintained — 2 devices remain
1oo21oo1UnchangedReduced — single point of failure
2oo20oo1 or 1oo1Depends on logicConsider tripping the SIF

Key risk: Voting degradation must be time-limited. A transmitter removed from voting because of a HART fault creates a window of reduced integrity. The SRS must specify the maximum allowable time a device can remain in degraded voting before the SIF is either restored or the process is shut down. This directly affects your PFDavg calculation.

Additionally, configure device alerts with appropriate alarm priorities — not everything is Critical. A device that has briefly lost HART communications but still has a valid analog signal is a different priority from a device that has declared a field device malfunction.

Fisher DVC6200 / DVC6000 — Get the Most From Your Valve Diagnostics

The DVC6000/DVC6200 series positioner sends four HART variables plus configurable slot variables. Key variables relevant to SIS operation:

  • HART_PV: Loop current in mA or %: primary valve control signal.
  • HART_SV: Auxiliary contact status (0 or 100%): confirms limit switch state.
  • HART_TV: Output pressure (psi/bar/kPa): detects air supply problems, line plugging.
  • HART_FV: Travel %: used for diagnostic command disagree alarming (not safety-rated position detection).
  • Air supply pressure (Slot Code #8): Configure this in DeltaV SIS to alarm on low or high air supply — it detects water, oil, or particulate plugging in the air supply line before the valve fails to actuate.

Partial Stroke Test (PST) via HART: The DVC6000/DVC6200 can initiate and report PST results via HART. The DeltaV SIS can automate this at configurable intervals. PST results are automatically recorded in the DeltaV Event Chronicle. Include a successful PST as a commissioning acceptance criterion for any SIS valve with this positioner.

🔧
Valve Signature Trending

Capture the initial valve signature during commissioning. At each subsequent PST, compare the new signature against the baseline. Erratic movement patterns indicate friction development, bushing wear, or packing degradation — long before the valve fails a full test.

Rosemount 3051S — Manage the Impulse Line Plugging Diagnostic Carefully

The Safety Certified Rosemount 3051S detects plugged impulse lines by monitoring millisecond-scale pressure noise. Under normal flowing conditions, small natural pressure deviations are present. As flow decreases or plugging occurs, these deviations fall to a minimum value. This is a powerful diagnostic but it requires careful masking logic.

Critical issue: During low or zero flow conditions (unit shutdown, minimum flow turndown, startup), the natural pressure noise disappears. Without masking logic in the SIS, the plugging diagnostic will generate spurious alarms or trigger false transmitter failure actions.

  • Add masking logic tied to confirmed low-flow or shutdown states.
  • Document the masking conditions in the SRS and in the operating procedures.
  • Include masking verification in the commissioning checklist: test the alarm with flow, and confirm it is masked without flow.

Also note the damping setting: the factory default on the 3051S is 3.2 seconds. If the SIS has a 500 ms to 1 second delay timer in logic to suppress spurious trips on short spikes, verify that the transmitter damping plus the logic delay timer does not exceed the Process Safety Time for the SIF. This calculation must be in your SRS.

Rosemount 3144P — Use Sensor Drift Alert and Dual Sensor Diversity

The Safety Certified Rosemount 3144P temperature transmitter offers features that directly improve SIL performance when correctly configured:

  • Redundant sensors with hot backup: If the primary sensor fails, the secondary immediately takes over. Reduces spurious trips from single sensor failures significantly.
  • Sensor drift alert: Configurable deviation alarming between the two sensors. This is one of the best available methods for detecting gradual sensor degradation — and detecting it well before it becomes a safety issue. Use U2 (Warning Mode) or U3 (Alert Mode) configurations for SIS applications.
  • Sensor diversity: For the dual sensor configuration, consider using an RTD and a thermocouple. Different sensor types reduce the common cause failure probability — and this reduction should be reflected in your SIL verification calculations. If you claim the credit in SIL calculations, you must prove it during proof testing.
  • Default damping is 5 seconds — check this against your Process Safety Time.
Part Three

Proof Testing and Lifecycle Management

SIS components accumulate hidden failures silently. A transmitter can develop a sensor drift that causes it to read incorrectly at the trip setpoint — but read perfectly at normal operating conditions. A shutdown valve can develop friction that prevents full closure — but travel correctly during partial stroke. A logic solver I/O card can develop a soft fault that does not trigger its continuous diagnostics. These are Dangerous Undetected (DU) failures. The only way to find them is a proof test.

IEC 61511 Part 1 Clause 16 defines the requirements for proof testing. A proof test is a periodic test performed to detect dangerous hidden failures in a safety-related system, and to verify that the SIF will operate as required when demanded.

Understand Why Proof Testing Directly Controls Your SIL

The Probability of Failure on Demand average (PFDavg) — the number that determines whether your SIF meets SIL-1, SIL-2, or SIL-3 — is directly linked to the proof test interval (TI). Simplifying the standard formula for a 1oo1 element:

PFDavg ≈ λDU × TI / 2

Double the proof test interval, and you double the PFDavg. Halve it, and you halve the PFDavg. If your SIL verification shows you are barely meeting SIL-2 at a one-year proof test interval, you will fail SIL-2 at two years. This is not a theoretical concern but it is the number your process safety management system must track.

Testing frequency must match what was specified during SIL determination and documented in the SRS. If the proof test is late, the SIF is operating outside its validated integrity. Regulatory compliance is also directly affected.

Understand the Difference Between Full and Partial Proof Testing
Attribute Full Proof Test (End-to-End) Partial Proof Test
CoverageComplete SIF — sensor to final elementSubset of components or partial functionality
PFDavg restorationReturns PFDavg to original targetReturns PFDavg to a percentage of original
Valve test coverageFull stroke — 100% travelPartial stroke (typically 10–20% travel)
Process disruptionHigh — typically requires bypass or shutdownLow — usually online without process disruption
IEC 61511 standingSatisfies full proof test requirementSupplements only — cannot replace full test
Documentation requiredFull test record, who performed, resultsPST record, pass/fail, time stamp, chronicle

The ideal proof test is end-to-end. Once the final element (valve) has been proven in its required proof test interval, it is sometimes sufficient to test each initiator separately. However: this must be documented in the proof test procedures and justified in the SIL verification. You cannot arbitrarily split the test without accounting for the coverage factor in your PFDavg calculation.

⚠️
Common Mistake

Teams assume that testing the transmitters and the logic solver is a "complete" proof test. Without testing the final element — that the shutdown valve actually closes and achieves seat leakage within specification — your proof test is incomplete and your PFDavg calculation is invalid.

Use DeltaV SIS Built-In Proof Testing Tools — They Are There for a Reason

Logic Solver (LS) Proof Testing

DeltaV SIS Logic Solvers must be proof tested per the specified interval. A proof test causes the LS card to run its power-up test while the partner card remains active. Two modes are available:

  • Manual: Engineer initiates from the DeltaV SIS Diagnostics application.
  • Automatic: Configured at user-specified intervals via Logic Solver properties in DeltaV SIS Explorer. An operator warning is generated before the test runs.

DeltaV SIS provides overdue alerts when proof tests are missed. These alerts must be linked to a formal work order system — an alert nobody acts on is not a safety control.

CHARM (Characterisation Module) Proof Testing

CHARMs must be proof tested at the interval specified for the associated SIF. A manual proof test is initiated from a diagnostic application at a DeltaV workstation — the CHARM resets and runs its power-up test. Proof test interval per CHARM can be set based on the associated SIF requirements, not as a single system-wide interval.

AMS Device Manager Integration

AMS Device Manager partnered with DeltaV SIS streamlines HART device proof testing substantially. Key capabilities:

  • Proof test capabilities in SIS devices can be activated directly from AMS — enabling partial online testing and extending offline proof test intervals.
  • QuickCheck SNAP-ON application facilitates interlock checkout — eliminates field runarounds, reduces exposure to process hazards (heights, heat, chemicals).
  • AMS automatically creates and timestamps records of all online tests. IEC 61511 Clause 16.2.2 requires that records certify proof tests and inspections were completed. AMS audit trail satisfies this requirement.
  • Two-point transmitter calibration can be completed from the workstation via HART command — no technician in the field required.

Syncade Workflow

Syncade Workflow operating with DeltaV guides technicians through proof test procedures step by step — both manual and automated steps — eliminating interpretation errors from paper work orders.

  • Document Control and Archiving (DCA) records all manual interactions.
  • Training module ensures only trained personnel execute specific test tasks.
  • Equipment Tracking (ET) handles proof test scheduling across all SIFs.
Bypass Management During Proof Testing Is a Safety-Critical Activity

When testing individual SIS components, bypasses are necessary to prevent spurious trips. But a bypass by definition removes a layer of protection. In the time a bypass is active, the process risk is elevated. This must be managed, not just permitted.

DeltaV SIS bypass management capabilities:

  • User privilege control: Only authorised personnel can apply a bypass. This is not just good practice — it is an IEC 61511 requirement that safety bypasses be subject to formal authorisation.
  • Voting scheme impact: Configure whether the bypass reduces the number of votes required to trip. For a 2oo3 loop with one transmitter bypassed, does it become 2oo2 or 1oo2? This decision must be in the SRS.
  • Bypass timeout and reminder: Set maximum bypass durations. DeltaV SIS generates alerts when a bypass timeout is approaching. If a bypass expires and is not cleared, the system alerts — so forgetting to remove a bypass after testing is caught automatically.
  • Operator faceplate bypass: Authorised operators can apply sensor bypass directly from the graphics during proof testing without leaving the control room.
🚨
Lesson Learned — Bypass Left in Place

On an offshore platform, a transmitter bypass applied during a proof test was not removed after testing was complete. The shift handover log did not capture it. The SIF operated with one transmitter permanently in bypass for three weeks before being discovered during the next routine inspection. Had a demand occurred during that period, the 2oo3 loop was effectively 1oo2 — not the verified SIL-2 configuration.

Partial Stroke Testing — Benefits, Real Limitations, and Common Misuse

Partial Stroke Testing (PST) is a method of testing shutdown valve operability without requiring a full stroke — typically 10–20% of travel — while the process remains online. The DeltaV SIS communicates with the DVC6000/DVC6200 via HART to execute and record PSTs automatically. No additional wiring or external components are required.

What PST Can Do

  • Detect stuck or high-friction valves early — before they fail a full proof test.
  • Provide diagnostic credit in PFDavg calculations — improving SIL performance or extending full proof test intervals.
  • Generate an alarm on failure. The valve remains available on demand even during the PST.
  • Be automatically initiated by the DeltaV SIS logic solver or manually from operator faceplates.
  • Results are automatically recorded in the DeltaV Event Chronicle with time stamp and pass/fail.

What PST Cannot Do

  • PST cannot detect a valve that fails to achieve seat leakage at full closure — you only tested 10–20% of travel.
  • PST cannot replace a full proof test. It supplements and extends the interval between full tests.
  • PST credit in SIL calculations must be quantified correctly using the diagnostic coverage factor from the vendor's data (IEC 61511-1 Ed.2 Annex A) — do not assume 60% or 90% coverage without data to support it.
  • PST max travel movement and travel speed are configurable — these must be set based on process dynamics to avoid a process upset during the partial stroke.

Common Misuse: Teams assume that annual PSTs replace the full proof test. They do not. IEC 61511 requires the full proof test at the interval validated in the SIL verification. PSTs extend that interval — they do not eliminate it.

Proof Tests Must Reflect Real Operating Conditions — and Records Are Non-Negotiable

A proof test that does not simulate the actual hazardous demand condition does not prove the SIF will work. An SIS proof test must:

  • Test the transmitter at — or through — the trip setpoint, not just at normal operating values.
  • Confirm that the final element achieves its required fail-safe state, not just that it moves.
  • For valves: confirm seat leakage is within the specification from the SRS. A valve that closes but leaks above the acceptable rate does not provide the isolation required.
  • Restore the SIF to an as-new condition, or as close as practical, after testing.
  • Be performed by trained personnel — Syncade Training module enforces this.

Records are an IEC 61511 Clause 16.2.2 legal requirement, not an administrative preference. Every proof test must document: who performed it, when it was performed, the test results for each component, any deficiencies found, corrective actions taken, and sign-off by a competent person. AMS Device Manager audit trail handles this automatically for device-level tests. Syncade DCA handles procedure-level records.

Implementation Guide

Commissioning & Operations Checklists

✅ HIPS Design Checklist

  • Reactive process hazard analysis completed with multidisciplinary team
  • All overpressure scenarios identified — including multi-failure paths
  • LOPA completed; SIL target derived for each SIF
  • Safety Requirement Specification (SRS) issued before design begins
  • SIL-3 target confirmed and third-party verification scoped where HIPS is sole layer
  • Response time calculated and verified against process safety time
  • Redundant transmitters on separate process taps
  • Logic solver SIL-3 certified per IEC 61508 with de-energise-to-trip configuration
  • Dual final elements in 1oo2 with dedicated block valves
  • Solenoids mounted as close to actuator as possible; large exhaust ports
  • Instrument air supply designed with sufficient volume and redundancy
  • Valve actuator closing force verified under worst-case upset pressure
  • Proof test interval specified in SRS and justified in SIL verification calculation

✅ DeltaV SIS HART Configuration Checklist

  • HART_ERRORS parameter configured for all HART-enabled CHARMs (not left at default "ignore all")
  • Each HART status signal mapped to correct action: voting degradation, alarm, or trip
  • Faulty transmitter ranges for 4–20 mA set to match device failure alarm setpoints (not saturation limits)
  • Analog-digital mismatch diagnostic enabled — ground loop detection is critical
  • PV Output Fixed alarm configured — transmitter in calibration mode must be detected
  • Impulse line plugging diagnostic masked during low-flow / shutdown conditions (3051S)
  • Transmitter damping + logic delay timer verified against Process Safety Time
  • 3144P sensor drift alert threshold configured and tested
  • DVC6000/DVC6200 air supply pressure monitoring configured (Slot Code #8)
  • Initial valve signature captured at commissioning for baseline comparison
  • Device alert priorities configured appropriately (Critical / High / Advisory)
  • HART alerts enabled to appear in alarm banner and alarm summary
  • HART 5 tag name eight-character limit respected in tag standard
  • HART communications behaviour on DVC6000 tested (capacitor test for loss-of-comms)

✅ Proof Testing Checklist — Per SIF

  • Proof test procedure reviewed and approved by competent person before test begins
  • Bypass authorisation obtained; bypass applied via DeltaV SIS with correct privilege level
  • Bypass timeout set; reminder alarm configured
  • Each transmitter tested through trip setpoint (not just at normal operating conditions)
  • Logic solver LS card proof test executed (manual or automatic per procedure)
  • CHARM proof test executed for all relevant CHARMs
  • Final element confirmed to achieve fail-safe state
  • Valve seat leakage measured and confirmed within SRS specification
  • Valve signature recorded (DVC6000/DVC6200) and compared against baseline
  • PST results recorded in DeltaV Event Chronicle with pass/fail status
  • All bypasses removed after test is complete; confirmed in control room
  • Test record completed in AMS Device Manager or Syncade DCA: who, when, results, sign-off
  • Any deficiency found raised as formal corrective action with target close-out date
  • SIF returned to normal operating configuration — no bypass, no override left in place
  • Next proof test due date confirmed and entered into maintenance scheduling system

✅ Annual Functional Safety Audit Checklist

  • All SIFs proof tested at required intervals — no overdue tests
  • All proof test records complete and signed off per IEC 61511 Clause 16.2.2
  • SRS review: no changes to process, setpoints, or voting logic without MOC process
  • All active bypasses reviewed and justified with documented time limits
  • Device alert configurations reviewed — no alerts permanently suppressed without documented justification
  • HART diagnostic credit claimed in SIL calculations confirmed active in system configuration
  • Valve signature trends reviewed for friction development
  • Any dangerous failures found during proof tests: corrective actions closed out
  • SIL verification calculations reviewed if any failure data, repair rates, or test intervals have changed
  • Personnel competency records current for all proof test technicians
Field Experience

Most Common SIS Engineering Mistakes — Ranked by Consequence

#MistakeConsequencePrevention
1HART_ERRORS parameter left at default "ignore all" in DeltaV SISAll HART diagnostics inactive — DU failures invisibleMandatory configuration step in SIS FAT checklist
2CSLS faulty transmitter range set within saturation limitsSpurious trips on valid process signalsSet equal to device failure alarm setpoints (e.g. 3.75/21.75 mA)
3Impulse line plugging alarm not masked during low flowNuisance alarms; alarm management degradationAdd flow-based masking logic in SIS; test at commissioning
4Bypass not removed after proof testSIF operates below SIL target indefinitelyBypass timeout in DeltaV SIS; Syncade workflow step to confirm removal
5PST assumed to replace full proof testSIL calculation invalid; regulatory non-compliancePST documented as supplemental — full test scheduled separately
6Response time not calculated for HIPSHIPS may not act before overpressure — validation gapCalculate in SRS; verify during FAT under simulated conditions
7HIPS designed on "expected" reaction path onlyReactive process takes unexpected path — HIPS not triggeredSystematic HAZOP of all reaction paths including multi-failure scenarios
8HART valve position used as SIL-rated safety signalSIS operates on non-safety-rated dataHardwired limit switch required for SIL-rated position detection
9Damping + delay timer not checked against Process Safety TimeSIF too slow to respond; overpressure not preventedExplicit calculation in SRS; verified at FAT
10Proof test does not test through the trip setpointHidden transmitter failure at trip setpoint not detectedTwo-point calibration via HART from AMS workstation
Closing

The Standard Is Only the Starting Point

IEC 61511 gives you the framework. DeltaV SIS gives you the tools. But neither prevents an incident if the engineering decisions are wrong, the configurations are left at defaults, or the proof tests are inadequate. The 20 best practices in this article are the gap between the standard and what actually protects people.

HIPS designed without a proper hazard analysis will fail the scenario it was never designed for. HART diagnostics ignored in the HART_ERRORS parameter add nothing to your SIL. Proof tests that test the transmitter but not the valve give you a false sense of security.

Functional safety is not an audit exercise. It is an engineering commitment — from the first HAZOP node to the last line in the proof test record. The engineers who take that seriously are the ones whose plants don't make the incident headlines.

💡
For Your Next Project

Start with the SRS. Verify the response time. Configure every HART_ERRORS parameter. Set bypass timeouts. Capture the baseline valve signature. Then test through the trip setpoint — not around it.

References

  1. Emerson Process Management. Consider These Safety Instrumented System Best Practices. Special Report. Authors: Angela E. Summers, Ph.D., P.E. (SIS-TECH Solutions); Alan Harris, Emerson Process Management; Sergio Diaz, Emerson Process Management.
  2. IEC 61511-1:2016. Functional Safety: Safety Instrumented Systems for the Process Industry Sector — Part 1: Framework, Definitions, System, Hardware and Application Programming Requirements. International Electrotechnical Commission.
  3. IEC 61511-3:2016. Guidance for the Determination of the Required Safety Integrity Levels. International Electrotechnical Commission.
  4. IEC 61508-1:2010. Functional Safety of Electrical/Electronic/Programmable Electronic Safety-Related Systems — Part 1: General Requirements. International Electrotechnical Commission.
  5. ISA TR84.00.02-2002. Safety Instrumented Functions (SIF) — Safety Integrity Level (SIL) Evaluation Techniques. International Society of Automation.
  6. API Recommended Practice 521, 6th Edition. Pressure-Relieving and Depressuring Systems. American Petroleum Institute.
  7. Center for Chemical Process Safety (CCPS). Guidelines for Process Equipment Reliability Data. American Institute of Chemical Engineers.
  8. Center for Chemical Process Safety (CCPS). Guidelines for Safe Automation of Chemical Processes. American Institute of Chemical Engineers.
  9. ASME Boiler and Pressure Vessel Code, Section VIII — Pressure Vessels. American Society of Mechanical Engineers.
  10. H.T. Dearden CEng FInstMC. Proof Testing of Process Plant Safety Instrumented Systems. Version 1, November 2011.
  11. Emerson Process Management. DeltaV HART Capabilities. White Paper, March 2009.
  12. Emerson Process Management. Configuring PlantWeb Alerts in a DeltaV System. White Paper, March 2009.
  13. Adler, B. Using HART to Increase Field Device Reliability. ISA, 2001.
  14. Summers, A.E. High Integrity Pressure Protective Systems. In: Instrument Engineers' Handbook, 3rd ed. CRC Press, 2002.
  15. Summers, A.E. Using Instrumented Systems For Overpressure Protection. Chemical Engineering Progress, Vol. 95, p. 85, November 1999.
  16. IEC 62443. Security for Industrial Automation and Control Systems. International Electrotechnical Commission.