Safety Instrumented System (SIS) Proof-Test Intervals, Maintenance Bypass Registers, and Compensating-Measure Governance

Topics: sis proof test bypass register software, sis lifecycle software, functional safety management.

Process safety engineers and instrumentation reliability leads ask a high-consequence operational question: How should refineries and gas plants track Safety Instrumented Function (SIF) proof-test intervals, MOS/maintenance bypass overrides, and compensating-measure expiry alarms? Distinct from DCS process alarm rationalization (O061) and general administrative safety bypass logs (O062), this workflow connects quantitative SIL verification models ($PFD_{\text{avg}}$, architectural constraints, and demand rates) directly to CMMS end-to-end instrument loop proof-test execution and safety PLC Maintenance Override Switch ($\text{MOS}$) telemetry.

When SIL verification calculations stay locked in static project engineering binders while CMMS work orders and control-room bypass logs operate independently, three severe process-safety gaps occur:

1. Unquantified proof-test deferrals: Turnaround schedules slip by $6\text{ to }9\text{ months}$, and maintenance planners defer an $\text{SIL 2}$ emergency depressuring valve proof test from $12\text{ months}$ to $21\text{ months}$ using a routine PM deferral code—unaware that the linear growth of the periodic failure term $\frac{1}{2},PTC,\lambda_{DU},T_1$ has pushed the loop's $PFD_{\text{avg}}$ beyond the LOPA target budget.
2. Incomplete "partial" proof tests credited as $100%$ tests: Instrument technicians calibrate a pressure transmitter with a HART communicator and stroke the solenoid pilot without full-stroking the main emergency block valve or measuring seat leakage, yet the CMMS resets the full proof-test clock as if $100%$ of dangerous undetected ($\lambda_{DU}$) failures were cleared.
3. Normalized or colliding MOS bypasses: An operator activates MOS-PT-204A to rod out a plugged transmitter impulse tap. The shift changes without re-verifying the manual board-operator watch (the required compensating measure), or a second technician places a common-mode blowdown valve on bypass in the same reactor train, leaving the unit with an unmitigated LOPA catastrophe scenario.

Scope and functional safety engineering boundary

An SIS proof-test and bypass register is a functional safety lifecycle ledger, quantitative $PFD_{\text{avg}}$ surveillance engine, and bypass escalation tracker; it is not an active safety logic solver or an automated PLC forcing tool.

• Functional Safety Engineer & PSM authority: All SIL target assignments, LOPA demand rates, dangerous undetected failure rates ($\lambda_{DU}$), common-cause $\beta$ factors, Proof-Test Coverage ($PTC$) percentages, Partial Stroke Test ($PST$) credits, and any extension of a proof-test interval beyond its Safety Requirements Specification ($\text{SRS}$) limit require formal Management of Change (MOC) signoff by a certified Functional Safety Engineer (CFSE / TÜV FSEng) and the Process Safety Management (PSM) Authority.
• Strict hardware isolation of the Safety PLC: The software register reads read-only OPC/Modbus status tags from the SIS logic solver (such as active MOS flags, trip counts, and diagnostic faults) and writes work orders to the CMMS, but must never have write access to force I/O points, toggle MOS switches, or modify application logic inside the safety PLC.
• Alignment with functional safety standards: Governance rules must comply with IEC 61511-1:2016+AMD1:2017 / ANSI/ISA-61511 (Functional safety — Safety instrumented systems for the process industry sector), IEC 61508 (reliability formulas), and OSHA 29 CFR 1910.119(j) (Mechanical Integrity).

1. Step 1 — Record intake & baseline identification: Refineries, gas plants, and petrochemical complexes spend heavily on **Layer of Protection Analysis (LOPA)** and **IEC 61511 / ISA-84** Safety Integrity Level ($\text{SIL}$) design studies during capital projects, only to let the assumed **Average Probability of Failure on Demand ($PFD_{\text{avg}}$)** silently degrade during operations when proof tests are deferred or partial-stroke coverage is misrecorded.
2. Step 2 — Cross-system reference & custody linkage: Every Safety Instrumented Function ($\text{SIF}$) relies on periodic manual **Proof Testing** (at interval $T_1$) with an engineered **Proof-Test Coverage ($PTC$)** to detect dangerous undetected ($\lambda_{DU}$) failures in sensors, logic solvers, and final emergency shutdown ($\text{ESD}$) or blowdown valves.
3. Step 3 — Exception quarantine & authority check: Placing a transmitter or valve on a **Maintenance Override Switch ($\text{MOS}$) / safety bypass** during online calibration or impulse-line clearing removes voting redundancy or disables trip action; a governed SIS register enforces pre-approved **Compensating Measures**, tracks maximum bypass duration clocks, and blocks overlapping bypasses within the same process hazard zone.
4. Step 4 — Verified disposition & audit trail closure: Software computes live $PFD_{\text{avg}}$ trajectories, tracks $PTC$ checklist completion, and escalates expiring MOS overrides, but never manipulates safety PLC logic forces directly or grants proof-test extensions without a certified Functional Safety Engineer's Management of Change (MOC) signoff.

Imperfect proof-testing, Partial Stroke Testing (PST), and bypass $PFD_{\text{avg}}$ mathematics

Under IEC 61508-6 and IEC 61511, real-world proof tests do not uncover $100%$ of dangerous undetected failures (for example, an offline full-stroke valve test without a high-pressure seat leak check may achieve a Proof-Test Coverage of $PTC = 85%$, leaving $1 - PTC = 15%$ of $\lambda_{DU}$ failures untested across the mission time $T_M$).

1. Imperfect proof-test $PFD_{\text{avg}}$ for a subsystem with effective dangerous undetected rate $\lambda_{DU,\text{eff}}$:

$$PFD_{\text{avg}}(T_1) = PTC \cdot \lambda_{DU,\text{eff}} \cdot \frac{T_1}{2} + (1 - PTC) \cdot \lambda_{DU,\text{eff}} \cdot \frac{T_M}{2}$$

For a redundant 1oo2 or 2oo3 subsystem, the common-cause failure contribution $\beta \cdot \lambda_{DU}$ dominates over the independent multi-channel product term, so the effective subsystem rate can be expressed via its independent voting term plus the common-cause term $\lambda_{DU,\text{CCF}} = \beta \cdot \lambda_{DU}$.

2. Impact of online Partial Stroke Testing ($PST$) at interval $T_{\text{PST}} \ll T_1$: When an automated Partial Stroke Test moves the emergency valve by $10%\text{--}15%$ of travel every $T_{\text{PST}}$ hours with diagnostic coverage $PTC_{\text{PST}}$, the periodic failure term splits into three components:

$$PFD_{\text{avg,with PST}} = PTC_{\text{PST}} \cdot \lambda_{DU,\text{eff}} \cdot \frac{T_{\text{PST}}}{2} + \left(PTC_{\text{full}} - PTC_{\text{PST}}\right) \cdot \lambda_{DU,\text{eff}} \cdot \frac{T_1}{2} + \left(1 - PTC_{\text{full}}\right) \cdot \lambda_{DU,\text{eff}} \cdot \frac{T_M}{2}$$

3. Impact of prolonged uncompensated bypass duration $T_{\text{bypass}}$: If a SIF or single channel is bypassed without an equivalent independent trip for $T_{\text{bypass}}$ hours during an evaluation year ($8,760\text{ h}$) where the degraded architecture has instantaneous unavailability $PFD_{\text{deg}}$, the annualized unavailability penalty added to the loop is:

$$\Delta PFD_{\text{bypass}} = \left(PFD_{\text{deg}} - PFD_{\text{norm}}\right) \cdot \frac{T_{\text{bypass}}}{8,760}$$

• Primary control scope: sis proof test bypass register software across compliance & safety and connected ERP/EAM records.
• Segregation boundary: Operational status updates never auto-close engineering, safety, or finance sign-off gates.
• Verification cadence: Reconcile open exceptions, overrides, and late adjustments at each shift or period close.

Illustrative worked example: Hydrocracker emergency depressuring SIF-HCU-204 proof-test deferral, MOS bypass penalty, and PST recovery

All figures below are illustrative and synthetic. Consider a refinery Hydrocracker Reactor High-Pressure Emergency Depressuring Safety Instrumented Function (SIF-HCU-204).

• SRS & LOPA target: Target $\text{SIL 2}$ ($PFD_{\text{avg}} \in [1.0 \times 10^{-3},; 1.0 \times 10^{-2}]$), with a specific LOPA risk-reduction target requiring $\text{RRF} \ge 222$, or maximum allowable loop probability of failure on demand:

$$PFD_{\text{max}} = \frac{1}{222.22} = 4.50 \times 10^{-3}$$

• Loop architecture & failure parameters (Mission Time $T_M = 87,600\text{ h}$ [$10\text{ years}$], Full Proof-Test Coverage $PTC_{\text{full}} = 0.85$):
  1. Sensors (2oo3 pressure transmitters PT-204A/B/C): Effective subsystem dangerous undetected failure rate (dominated by $\beta_s = 0.05$ impulse-line/diaphragm common cause plus voting contribution) $\lambda_{DU,\text{eff},s} = 7.20 \times 10^{-8}\text{ h}^{-1}$.
  2. Logic Solver (1oo2D safety PLC LS-204): $\lambda_{DU,\text{eff},l} = 1.50 \times 10^{-8}\text{ h}^{-1}$ (assumed fully tested at turnaround, $PFD_l \approx 1.31 \times 10^{-4}$ constant over the interval).
  3. Final Elements (1oo2 emergency depressuring blowdown valves BDV-204A/B with solenoids): Per-channel $\lambda_{DU,f} = 2.80 \times 10^{-6}\text{ h}^{-1}$ and common-cause factor $\beta_f = 0.10$, yielding effective subsystem rate $\lambda_{DU,\text{eff},f} = 3.10 \times 10^{-7}\text{ h}^{-1}$.

Total effective loop dangerous undetected rate for the imperfect-test formula (sensors + final elements) is:

$$\lambda_{DU,\text{eff}} = \lambda_{DU,\text{eff},s} + \lambda_{DU,\text{eff},f} = 7.20 \times 10^{-8} + 3.10 \times 10^{-7} = 3.82 \times 10^{-7}\text{ h}^{-1}$$

Step 1: Baseline $PFD_{\text{avg}}$ at design proof-test interval $T_1 = 8,760\text{ h}$ ($12\text{ months}$)

1. Periodic proof-tested term ($PTC_{\text{full}} = 0.85$, $T_1 = 8,760\text{ h}$):

$$PFD_{\text{periodic}}(12\text{ mo}) = 0.85 \times \left(3.82 \times 10^{-7}\right) \times \frac{8,760}{2} = 3.247 \times 10^{-7} \times 4,380 = 1.4222 \times 10^{-3}$$

2. Residual untested mission-time term ($1 - PTC_{\text{full}} = 0.15$, $T_M = 87,600\text{ h}$):

$$PFD_{\text{residual}} = 0.15 \times \left(3.82 \times 10^{-7}\right) \times \frac{87,600}{2} = 5.730 \times 10^{-8} \times 43,800 = 2.5097 \times 10^{-3}$$

3. Total baseline loop $PFD_{\text{avg}}(12\text{ mo})$ (including Logic Solver $PFD_l = 0.1310 \times 10^{-3}$):

$$PFD_{\text{avg}}(12\text{ mo}) = 1.4222 \times 10^{-3} + 2.5097 \times 10^{-3} + 0.1310 \times 10^{-3} = 4.0629 \times 10^{-3}$$

$$\text{RRF}(12\text{ mo}) = \frac{1}{4.0629 \times 10^{-3}} = 246.1\quad (\text{Compliant: } 4.063 \times 10^{-3} \le 4.500 \times 10^{-3})$$

Step 2: Impact of a $9\text{-month}$ turnaround deferral ($T_{1,\text{ext}} = 15,330\text{ h}$ [$21\text{ months}$]) plus uncompensated bypass

When the refinery turnaround is pushed back by $9\text{ months}$ ($T_{1,\text{ext}} = 15,330\text{ h}$), the periodic proof-test term grows linearly by $15,330 / 8,760 = 1.750$:

$$PFD_{\text{periodic}}(21\text{ mo}) = 0.85 \times \left(3.82 \times 10^{-7}\right) \times \frac{15,330}{2} = 3.247 \times 10^{-7} \times 7,665 = 2.4888 \times 10^{-3}$$

$$PFD_{\text{avg}}(21\text{ mo}) = 2.4888 \times 10^{-3} + 2.5097 \times 10^{-3} + 0.1310 \times 10^{-3} = 5.1295 \times 10^{-3}$$

$$\text{RRF}(21\text{ mo}) = \frac{1}{5.1295 \times 10^{-3}} = 195.0\quad (\text{Breach: } 5.130 \times 10^{-3} > 4.500 \times 10^{-3})$$

Additionally, during winter operations, BDV-204A is placed on a mechanical/MOS bypass for $T_{\text{bypass}} = 96.0\text{ h}$ ($4.0\text{ days}$) to repair a leaking actuator tubing fitting without lowering reactor pressure, temporarily degrading the 1oo2 final element to a single 1oo1 valve ($PFD_{\text{deg},f} \approx 2.80 \times 10^{-6} \times 7,665 = 2.146 \times 10^{-2}$). The annualized bypass penalty is:

$$\Delta PFD_{\text{bypass}} = \left(2.146 \times 10^{-2} - 2.489 \times 10^{-3}\right) \times \frac{96.0}{8,760} = 1.897 \times 10^{-2} \times 0.010959 = 2.079 \times 10^{-4}$$

This pushes the effective loop unavailability to $PFD_{\text{eff}} = 5.1295 \times 10^{-3} + 0.2079 \times 10^{-3} = 5.3374 \times 10^{-3}$ ($\text{RRF} = 187.4$, exceeding the LOPA ceiling by $+18.61%$).

Step 3: Risk recovery via monthly online Partial Stroke Testing ($PST$) under Functional Safety MOC

Rather than allowing an uncompensated deferral, the SIS register blocks the PM extension until the Functional Safety Engineer executes MOC MOC-SIS-2026-031. Because BDV-204A/B are equipped with digital valve positioners qualified for online Partial Stroke Testing ($PST$) at $15%$ travel every $T_{\text{PST}} = 730\text{ h}$ ($1\text{ month}$) with diagnostic coverage $PTC_{\text{PST}} = 0.60$ (while sensors PT-204A/B/C are still proof-tested online every $8,760\text{ h}$ using the 2oo3 online channel-by-channel test header), the final-element periodic $PFD$ over the $21\text{-month}$ ($15,330\text{ h}$) valve turnaround interval becomes:

1. Sensor periodic term (tested online at $T_{1,s} = 8,760\text{ h}$):

$$PFD_{\text{periodic},s} = 0.85 \times \left(7.20 \times 10^{-8}\right) \times \frac{8,760}{2} = 0.2681 \times 10^{-3}$$

2. Final element PST-assisted periodic term ($T_{\text{PST}} = 730\text{ h}$, $T_{1,f} = 15,330\text{ h}$, $PTC_{\text{PST}} = 0.60$, $PTC_{\text{full}} = 0.85$):

$$PFD_{\text{periodic},f,\text{PST}} = \left[0.60 \times \frac{730}{2} + (0.85 - 0.60) \times \frac{15,330}{2}\right] \times \left(3.10 \times 10^{-7}\right)$$

$$PFD_{\text{periodic},f,\text{PST}} = \left[219.0 + 1,916.25\right] \times \left(3.10 \times 10^{-7}\right) = 2,135.25 \times 3.10 \times 10^{-7} = 0.6619 \times 10^{-3}$$

3. Total MOC-governed loop $PFD_{\text{avg}}$:

$$PFD_{\text{avg,MOC}} = 0.2681 \times 10^{-3} + 0.6619 \times 10^{-3} + 2.5097 \times 10^{-3} + 0.1310 \times 10^{-3} = 3.5707 \times 10^{-3}$$

$$\text{RRF}_{\text{MOC}} = \frac{1}{3.5707 \times 10^{-3}} = 280.1\quad (\text{Restored inside LOPA budget: } 3.571 \times 10^{-3} \le 4.500 \times 10^{-3})$$

Independent arithmetic verification

• Baseline $12\text{-month}$ check: Periodic $= 0.85 \times 3.82 \times 10^{-7} \times 4,380 = 1.422186 \times 10^{-3}$. Residual $= 0.15 \times 3.82 \times 10^{-7} \times 43,800 = 2.50974 \times 10^{-3}$. Sum with logic solver ($0.1310 \times 10^{-3}$) $= 4.062926 \times 10^{-3}$; $\text{RRF} = 1 / 0.004062926 = 246.13$.
• $21\text{-month}$ deferral check: Periodic $= 0.85 \times 3.82 \times 10^{-7} \times 7,665 = 2.488826 \times 10^{-3}$. Total $= 2.488826 \times 10^{-3} + 2.64074 \times 10^{-3} = 5.129566 \times 10^{-3}$. With $96\text{ h}$ bypass penalty ($0.2079 \times 10^{-3}$), $PFD_{\text{eff}} = 5.337466 \times 10^{-3}$ ($5.3375 / 4.5000 = 1.1861$, $+18.61%$ over budget).
• MOC PST check: Sensor periodic $= 0.85 \times 7.20 \times 10^{-8} \times 4,380 = 2.68056 \times 10^{-4}$. Valve PST periodic $= (0.60 \times 365 + 0.25 \times 7,665) \times 3.10 \times 10^{-7} = (219 + 1,916.25) \times 3.10 \times 10^{-7} = 6.619275 \times 10^{-4}$. Combined periodic $= 9.299835 \times 10^{-4}$. Total loop $PFD_{\text{avg,MOC}} = 0.9300 \times 10^{-3} + 2.6407 \times 10^{-3} = 3.5707 \times 10^{-3}$; $\text{RRF} = 1 / 0.0035707 = 280.06$, independently verified.

Workflow, owner roles, exception handling and recovery controls

Bounded pilot and implementation check

Validate the SIS proof-test and bypass register across one high-hazard process unit ($15\text{--}30$ SIFs across $\text{SIL 1}$, $\text{SIL 2}$, and $\text{SIL 3}$) using four acceptance tests:

• ACT-O107-01 (Imperfect proof-test $PFD_{\text{avg}}$ & PST math verification): Confirm that for every pilot SIF, the software reproduces the SRS baseline $PFD_{\text{avg}}$ (including both periodic $PTC \cdot \lambda_{DU} \cdot T_1/2$ and residual $(1-PTC)\cdot \lambda_{DU} \cdot T_M/2$ terms plus PST credits) within $\pm 1.0%$ of the approved SIL verification sheet.
• ACT-O107-02 (PM deferral block on LOPA budget breach): Simulate a $9\text{-month}$ proof-test deferral on an $\text{SIL 2}$ loop operating near its LOPA budget; verify that the system flags the $PFD_{\text{avg}} > PFD_{\text{max}}$ breach and blocks CMMS date changes without an attached Functional Safety Engineer MOC.
• ACT-O107-03 (As-found failure capture before as-left reset): Attempt to close a proof-test work order where the initial stroke time exceeded the SRS limit (e.g., $14.2\text{ s}$ vs $10.0\text{ s}$ max) as a simple "Pass"; confirm the system enforces an As-Found DU Failure classification and updates the historical failure rate ledger.
• ACT-O107-04 (MOS bypass collision & expiry escalation): Simulate two simultaneous MOS bypasses on SIFs sharing the same LOPA hazard node, or a single bypass exceeding its $12\text{-hour}$ permit window; verify immediate hazard-collision blocking and shift-superintendent escalation.

Next actions

1. Extract SRS parameters into a structured digital SIF register: Migrate PDF SIL verification sheets into a live database capturing subsystem $\lambda_{DU}$, $\beta$, voting architecture, $T_1$, $PTC_{\text{full}}$, $PTC_{\text{PST}}$, maximum stroke times, and LOPA $PFD_{\text{max}}$ budgets.
2. Restructure CMMS proof-test job plans around As-Found / As-Left steps: Separate routine transmitter calibration PMs from true end-to-end IEC 61511 proof tests, and mandate recording the initial unassisted trip stroke time and seat leakage before any mechanical adjustment.
3. Integrate read-only SIS MOS and PLC force tags with the e-PTW/bypass log: Stream live Maintenance Override Switch states from the safety logic solver into the control-room bypass register so no manual or software bypass can exist without an active compensating-measure timer.
4. Institute monthly PSM review of live $PFD_{\text{avg}}$ and As-Found DU rates: Compare observed field demand and proof-test failure rates against LOPA design assumptions every quarter per IEC 61511-1 Clause 16.

Frequently Asked Questions

How should refineries and gas plants track Safety Instrumented Function (SIF) proof-test intervals, MOS/maintenance bypass overrides, and compensating-measure expiry alarms?

Teams should govern sis proof test bypass register software by linking every transaction to its source evidence, timestamp, and assigned owner before permitting downstream posting. Distinct from O061 (alarm management rationalization) and O062 (safety bypass register general); O107 links SIL demand-rate assumptions and proof-test coverage records to CMMS instrument loop checklists so overdue proof tests or prolonged overrides trigger formal risk-review escalations. Rather than relying on informal spreadsheet overrides, the workflow enforces a documented verification gate and preserves the original observation whenever a correction is recorded.

How does sis lifecycle software handle exceptions and mismatches?

When a discrepancy occurs during sis lifecycle software, the system routes the blocked record into an owned exception queue rather than silently dropping or auto-adjusting the balance. Assigned operational, quality, and finance owners must review and approve exceptions before posting. Each exception retains the original quantity, date, and counterparty reference until the designated reviewer resolves the variance with supporting evidence.

What should teams test before automating functional safety management?

Before scaling functional safety management, run a bounded pilot using historical records that include partial receipts, late updates, duplicate messages, and rejected lines. Verify that the integration preserves idempotency, maintains a clear segregation of duties between operational entry and financial approval, and produces an auditable trail for every state transition.

Summary and next actions

1. Map the current sis proof test bypass register software record boundaries, system of record, and named approval owners before changing workflow rules.
2. Separate operational status updates from engineering, safety, or financial disposition sign-off.
3. Validate exception queues, duplicate handling, and cutoff reconciliation in a bounded pilot before production rollout.