Extending a SIL 2 Proof Test Interval and Running a 30-Day Bypass

The extension as proposed cannot be accepted.

For a periodically proof-tested element, the dominant undetected term behaves as PFDavg ≈ λDU × TI / 2, i.e. it scales with the interval. Tripling TI from 12 to 36 months roughly triples the contribution of every element whose failures are only caught by the proof test:

4.2 × 10⁻³ × 3 ≈ 1.26 × 10⁻² - outside the SIL 2 band (1 × 10⁻³ to 1 × 10⁻²) and into SIL 1. The direction and order of magnitude are unambiguous; refinement changes the digits, not the conclusion.

Refinements to apply before you commit to a number:

• The scaling is not perfectly linear because PTC is 80% (transmitters) and 60% (valve). Only the tested fraction is reset each interval; the residual undetected fraction accumulates over the whole period regardless. Request the verification worksheet and recompute per element with the actual λDU and PTC rather than scaling a single lumped figure.
• The 1oo1 final element with 60% PTC is the weak link. It very likely dominates the 4.2 × 10⁻³. Increasing sensor redundancy buys little; a second trip valve (1oo2 final element) buys a great deal - often more than a year of proof testing.

Alternatives that keep the turnaround alignment

1. Staged partial proof tests: a valve partial stroke test at 12 and 24 months plus a transmitter calibration, so no element goes more than 12 months untested. This can restore the PFDavg - but only if the PST's PTC is justified and credited honestly. A PST exercises the stroke, not the solenoid, the air supply, or full closure; claiming 80% coverage for it is common and frequently wrong.
2. Add redundancy on the final element and re-verify.
3. If neither is affordable, re-run the LOPA. If SIL 2 is genuinely required to meet the site's tolerable risk, a cost-driven interval extension is not available; it becomes a formal, documented risk-acceptance decision at the appropriate management level.

Any change here is a change to the SIS under the site's MOC procedure - the SIL verification must be re-issued, not amended by memo.

Quantification

The SIF provides no protection for 30 days. As a fraction of the year, 30/365 = 8.2%.

Average PFD for the year ≈ (335/365 × 4.2 × 10⁻³) + (30/365 × 1.0) = 3.9 × 10⁻³ + 0.082 ≈ 8.6 × 10⁻²

The bypass term dominates by more than an order of magnitude. For that year the loop delivers SIL 1 at best, and only just. A 30-day full bypass of a SIL 2 trip is a major risk decision, not a maintenance detail.

Controls required before approval

• Shorten it. The gasket work itself is hours. Ask why the SIF must be defeated for 30 days to support a few hours of work: can the flange be isolated with double block and bleed? Can the work be done during a shutdown, or with the reactor at reduced pressure/rate such that the trip point is not reachable?
• Formal MOC with a hazard review, approved at the level the site procedure requires for defeating a SIL 2 function.
• Compensating measures: an independent high-pressure alarm on a separate measurement, with a justified operator response. Calculate the time available (pressure rise rate from the credible worst case versus the alarm, the operator's response, and the time to act) and show it is adequate. Add a dedicated operator/continuous presence requirement for the duration.
• Hard time limit and automatic escalation; a bypass register entry with signature, start and end timestamps, and a named owner.
• Restoration verification: confirm the bypass is physically removed and the SIF is proof-tested or functionally verified before returning to normal operation. A forgotten bypass is the single most common cause of a SIF failing on demand.

Classification first. The drift was found by the proof test, so it is a detected failure - it does not enter λDU and does not by itself invalidate the PFDavg calculation. Its significance is in what it implies, in three directions:

1. Common cause. Are the two transmitters on the same tap/manifold? If a shared root valve or impulse line is partially plugged, both read low together and the 1oo2 redundancy is illusory. One drifting and one healthy points at the device or its calibration; both drifting points at a shared impulse line and a common-cause failure the SIL verification probably did not model. Check the impulse lines and the manifold before blaming the instrument.
2. Setpoint margin. 2.5% of a 50 barg span = 1.25 bar, five times the ±0.5% tolerance. With the trip at 35 barg and normal at 32 barg, the effective trip point could have been anywhere from 33.75 to 36.25 barg. The low side means spurious trips and lost production; the high side eats 1.25 of the 3 bar available margin. Confirm the pressure relief and any high-pressure alarm still cover the late-trip case.
3. The calibration and PTC assumptions. The SIL verification assumed a 12-month calibration interval and a stated PTC. An as-found error five times the tolerance is evidence that the assumed drift behaviour is optimistic. Do not extend this interval to 36 months on this evidence.

Actions: recalibrate and record as-found/as-left; root-cause the drift (hot location, ambient temperature effect, static-line pressure effect, incorrect reference/zero, moisture in the impulse line); pull the calibration history of the other transmitter to see whether 12 months is right or too long; consider a quarterly calibration check of the pair until confidence is restored; and if the device is a smart transmitter, confirm its self-diagnostics are enabled and routed to an alarm rather than sitting unused.