18.2 Operation, Proof Testing, Demands, and Bypasses

NCEES PE Control Systems Engineering Exam Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Handbook, ISA-5.1, and IEC 61511 on Exam Day 1.3 CBT Strategy, AITs, Calculators, and Pacing

2 Process Measurement Sensors

2.1 Pressure, Level, and Temperature Sensors 2.2 Flow, Counter, and Motion Sensors 2.3 Analytical Instruments and Sampling Systems

3 Specialty Sensors and Characteristics

3.1 Fire and Gas Detectors 3.2 Machinery Monitoring and Protection 3.3 Sensor Characteristics: Accuracy, Calibration, and Dynamics

4 Selection, Installation, and Primary Calculations

4.1 Sensor Selection and Material Compatibility 4.2 Sensor Installation Details and Drawings 4.3 Flow Calculations 4.4 Level Calculations

5 Conversions, Thermowells, and Checkout

5.1 Process Measurement Unit Conversions 5.2 Thermowell Design and Wake Frequency 5.3 Sensor Testing and Commissioning

6 Drawings, Dynamics, and PID

6.1 P&IDs, Loop Diagrams, and ISA-5.1 Symbology 6.2 Process Dynamics and Loop Response 6.3 Feedback Control and PID

7 Advanced, Discrete, and Process Applications

7.1 Feedforward, Cascade, Ratio, Override, and Split-Range 7.2 Discrete and Sequential Control 7.3 Control of Common Process Equipment

8 HMI, Alarms, Logic, and Architecture

8.1 HMI, Displays, and Control-Room Layout 8.2 Alarm Management 8.3 IEC 61131-3 Logic Implementation 8.4 DCS, PLC, SCADA Architecture and Interfaces

9 Capacity, Testing, and Cybersecurity

9.1 Capacity, Availability, Heat Load, Power, and Environment 9.2 FAT, IST, SAT, and Commissioning 9.3 Performance Monitoring and Management of Change 9.4 Control-System Cybersecurity

10 Valve Type, Trim, Sizing, and Actuators

10.1 Valve Types and Materials 10.2 Valve Trim, Leakage Class, and Characteristics 10.3 Valve Sizing, Pressure Drop, and Split-Range 10.4 Actuators and Failure Modes

11 Fluid Dynamics, Accessories, and Relief Types

11.1 Cavitation, Flashing, Choked Flow, and Noise 11.2 Valve Accessories and Installation 11.3 Pressure-Relieving Device Types and Installation 11.4 Pressure-Relieving Device Calculations

12 Motors, Solenoids, Regulators, and Checkout

12.1 Motor Starters, VSDs, and Soft Starters 12.2 Solenoid Valves and Relays as Final Elements 12.3 Self-Regulating Devices 12.4 Final Element Testing and Commissioning

13 Signal Types and Conversion

13.1 Analog and Discrete Signal Types 13.2 Buses, Topologies, and Digital Protocols 13.3 Signal Conversion, I/P, Splitters, and Bit Precision

14 Hazardous Areas, Power, and Circuits

14.1 Hazardous-Area Methods and Intrinsic Safety 14.2 Power, Grounding, Segregation, and EMI 14.3 Two-Wire, Four-Wire, and Loop Calculations

15 Media and Network Architecture

15.1 Transmission Media: Copper, Fiber, Wireless 15.2 TCP/IP, OPC, Addressing, and Architectures 15.3 OPC, Network Addressing, and Segmentation

16 Lifecycle and Risk Allocation

16.1 IEC 61511 Lifecycle Structure and Phases 16.2 Hazard and Risk Assessment 16.3 LOPA, IPLs, and SIF Identification

17 SRS, Design, and SIL Calculations

17.1 Safety Requirements Specification 17.2 SIS Design, Device Selection, and Constraints 17.3 SIL Calculations and Formulas

18 SAT, Proof Testing, and MOC

18.1 Installation, Commissioning, Validation, and SAT 18.2 Operation, Proof Testing, Demands, and Bypasses 18.3 Modification, Decommissioning, and MOC

18.2 Operation, Proof Testing, Demands, and Bypasses

Key Takeaways Explain This Topic AI

ISA/IEC 61511-1:2018 Clause 16 requires operating and maintenance procedures covering inspection, proof testing, demand recording, failure reporting, and bypass management so the claimed SIL remains valid.

Automatic diagnostics convert some dangerous failures into dangerous-detected failures; proof tests are intended to reveal remaining dangerous-undetected failures, and proof-test coverage is rarely 100%.

For a simplified 1oo1 undetected term, PFDavg ≈ λ_DU × T_proof / 2; extending T_proof from 1 year to 3 years at λ_DU = 2.0×10⁻⁶/h raises PFDavg from about 0.0088 (SIL 2 band) to about 0.026 (SIL 1 band) if nothing else changes.

Successful and failed demands must both be recorded; a successful demand still counts toward the assumed demand rate, and a failed demand is a dangerous failure that escaped diagnostics and prior proof tests.

Bypasses require authorization, time limits, and compensating measures; partial-stroke tests increase diagnostic coverage of some valve stuck failures but do not by themselves prove full-travel dangerous failure modes.

Last updated: August 2026

Why operations keep or lose the SIL claim

NCEES PE Control Systems 2027 item 5.F tests operation and maintenance : inspection, testing, demands, failures and failure rates, causes, bypass management, and degradation. ISA/IEC 61511-1:2018 Clause 16 is the matching lifecycle phase. SIL verification done at design is a prediction. The prediction stays valid only if the plant actually inspects, proof-tests, records demands, restores failures within the assumed mean time to restoration, and manages bypasses. A SIF that was SIL 2 on paper is not SIL 2 in service if proof tests are skipped, diagnostic alarms are shelved, or a bypass is left in.

Inspection versus proof testing versus automatic diagnostics

Inspection looks for visible or environmental degradation: corrosion, leaking packing, heat-traced impulse lines that froze, missing bolting, water in a junction box, a blocked flame-arrestor on a gas detector. Inspection does not stroke the valve or inject a trip.

Automatic diagnostics run while the SIF is in service. Examples: transmitter out-of-range, NAMUR NE 43 failure current, solenoid-circuit continuity, discrepancy in 2oo3 voting, partial-stroke signature on a smart positioner. Failures they reveal are dangerous detected (DD) . In PFDavg they sit behind mean time to restoration, not behind the full proof-test interval, provided the diagnostic is enabled, alarmed, and repaired.

A proof test is a planned, documented functional test intended to reveal dangerous undetected (DU) failures so the channel can be restored. Proof-test coverage (often written C_PT) is the fraction of DU failures the procedure actually finds. Coverage is not 100% if the test injects a signal at the transmitter terminals and never proves the process tap is open, or if it trips the logic but does not confirm the valve reaches the safe state. Residual DU failures after an imperfect proof test accumulate over useful life or overhaul interval, not only over T_proof.

Failure rates, causes, and degradation

Random hardware failures are quantified as λ_DD and λ_DU (and safe-failure counterparts). Systematic failures are not “averaged away” by a λ: a wrong setpoint after an undocumented change, a bypass key left in, a proof-test procedure that cannot be performed, firmware loaded on the wrong revision. Clause 16 expects both classes to be investigated.

Degradation is the slow movement from the as-validated condition toward higher DU failure rates: packing that sticks after months of no travel, impulse-line plugging, diagnostic coverage that was 90% in the certificate but is 0% because the alarm is suppressed, instrument air that no longer meets the dew-point assumption. Demand-mode SIL claims assume the failure rates used in verification; if degradation is ignored, PFDavg is optimistic.

Failure mode (example) Typically detected by automatic diagnostics? Revealed by a complete proof test? Remains undetected if both are weak

Transmitter output stuck in range No, unless comparison/voting or process-correlation diagnostics exist Yes, if the test drives the actual process variable or a traced overlapping simulation Yes — classic DU; plugged tap with a healthy 4–20 mA signal

Transmitter out of range / NE 43 failure current Yes, if the diagnostic is enabled and alarmed Yes Unlikely if diagnostics are in service

Logic-solver I/O channel fault Often yes (I/O diagnostics) Yes, if the test exercises that channel Possible if diagnostics are disabled or the test uses a different channel

Solenoid coil open (de-energize-to-trip) Often yes (continuity / output readback) Yes Unlikely if the circuit is monitored

Valve stuck off the seat (will not complete stroke) Partial stroke may catch some stiction Full-stroke proof test, timed to the safe state Yes if only partial stroke is used and full travel is never proven

Valve leaks through when “closed” No Only if the proof test includes leak tightness / downstream isolation Yes — tightness is a different dangerous mode from “did it move 15%”

Bypass left active Only if bypass is alarmed and not shelved Inspection of bypass status during the test Yes — systematic, not a λ_DU term

Recording demands: successful versus failed

Clause 16 requires recording demands and failures . A successful demand means the hazardous condition occurred (or a real process demand was placed on the SIF) and the SIF achieved the safe state. Log it. It still counts toward the demand rate used in LOPA and in the low-demand versus high-demand mode decision. If the SRS and LOPA assumed one demand in ten years and operations see three demands in two years, the SIL verification and even the demand mode may be invalid.

A failed demand means the SIF was called and did not achieve the safe state in time. That is a dangerous failure that escaped diagnostics and prior proof tests. Treat it as a functional-safety incident: restore the process, investigate cause (random hardware versus systematic), repair, re-validate the affected portion, and feed the failure into the reliability dataset. Do not discard successful trips from the log to “keep the assumed demand rate low.”

Bypass management and compensating measures

Bypassing a SIF, or a channel of a SIF, removes that risk reduction for as long as the bypass is in. ISA/IEC 61511-1:2018 requires written procedures, authorization, logging, and compensating measures that keep risk acceptable while the function is unavailable. Typical measures: continuous occupancy and a specified operator action, a temporary independent trip, reduced throughput, or taking the equipment out of service. If the compensating measure is an operator responding to an alarm, that alarm and procedure need MOC-level discipline and testing; it is not a casual radio call.

Time limits belong in the SRS or the operating procedure. Exceeding the limit is a modification, not an extension of the same bypass. A bypass that becomes the normal way to run the unit is a design change and a LOPA change. Forgotten bypasses are a leading systematic cause of lost protection.

When a diagnostic or proof test finds a dangerous fault, the same rule applies until repair: compensating measures or a specified action to the safe state, within the restoration time used in the PFDavg model.

Partial stroke versus full stroke

Partial-stroke testing (PST) typically moves a shutdown valve a limited travel (often on the order of 10–20%) and looks at signature, pressure, or limit-switch response. PST can raise diagnostic coverage of some stuck-shaft and stiction modes without shutting the process down. It does not prove full travel, closing time against process safety time, or seat tightness. Full-stroke proof tests remain necessary for the dangerous modes PST cannot see, unless a documented failure-mode analysis shows equivalent coverage and the SIL verification uses that coverage. Credit for PST is an engineering change to λ_DD/λ_DU and possibly to T_proof, not a verbal “we wiggle it quarterly.”

Worked example: extending T_proof without recalculating PFD

SIF-310 is claimed SIL 2 in low demand. A simplified 1oo1 undetected term (the sensitivity model the exam likes, not a full IEC 61508 verification) uses λ_DU = 2.0×10⁻⁶ /h for the dominating channel and T_proof = 1 year = 8,760 h:

PFDavg ≈ λ_DU × T_proof / 2 = (2.0×10⁻⁶)(8,760)/2 = 0.00876

That sits in the SIL 2 low-demand band (0.001 to 0.01). Operations wants to extend proof testing to 3 years because a full stroke requires a unit outage. New T_proof = 26,280 h, nothing else recalculated:

PFDavg ≈ (2.0×10⁻⁶)(26,280)/2 = 0.0263

0.0263 is in the SIL 1 band (0.01 to 0.1). The SIL 2 claim is lost even before adding DD restoration, common cause, and C_PT < 1. If proof-test coverage is only 70%, 30% of DU failures never reset at T_proof and grow over useful life, making the real PFD worse still. Lawful paths: keep T_proof = 1 year, add diagnostics/PST with a revised verification, change architecture, or reduce the SIL claim and revisit LOPA. Extending the calendar without recalculating PFDavg is not a path.