Calibration drift changes loop gain and evades IEC 61511 alarms

A SAG mill discharge pressure transmitter reads 4.02 mA at zero gauge instead of 4.00 mA. The shift is 0.5% of span. It passes the loop check, the DCS shows nothing abnormal, and the operator sees a pressure trend that looks like every other shift. Six months later the same transmitter reads 4.18 mA at zero. Loop gain has moved 4.5% from design. The high-pressure trip still functions, but it now asserts at a different true pressure than the trip setpoint in the safety requirements specification. Nothing in the alarm log flags it.

This is the failure mode worth dismantling: calibration drift that changes loop gain without crossing any alarm threshold. It is not a sensor failure in the conventional sense. The transmitter is still powered, still communicating, still inside its published accuracy band if you only check the 4–20 mA output against a reference at one point. The problem is that the loop’s dynamic behaviour has changed, and the alarm and trip functions that depend on that loop now respond at different process conditions than the ones assumed during design.

The mechanism: gain, not offset

Calibration drift is usually described as a zero or span error. In a pressure or differential-pressure loop, a zero shift adds a constant offset to the measured variable. A span shift multiplies it. The span shift is the one that matters for functional safety, because it changes the relationship between the process variable and the signal the logic solver receives.

Take a flow loop with a differential-pressure transmitter and a square-root extractor. The measured flow is proportional to the square root of differential pressure. If the transmitter span drifts by 2%, the extracted flow drifts by roughly 1% at the same differential pressure, but the error is not constant across the range. At low flow the absolute error is small. At high flow it is larger. A high-flow trip set at 90% of range may now assert at 89% or 91% of true flow depending on the direction of drift.

The loop gain — the ratio of output change to input change across the whole loop — has moved. The controller tuning, which was set for the original gain, is now slightly wrong. The process variable wanders a little more, or a little less, than the alarm deadband expects. The alarm still works. It just works at a different point.

Why conventional alarms miss it

Alarms are threshold devices. They assert when a variable crosses a limit. Calibration drift that keeps the variable inside the normal operating band never triggers them. The drift is only visible if you compare the indicated value against an independent reference, or if you examine the loop’s response to a known input.

Most condition-monitoring on a plant watches for step changes: a transmitter that fails to 3.6 mA, a signal that goes open circuit, a deviation that exceeds a fixed band. These catch hard failures. They do not catch a 0.5% per year span shift that is well inside the alarm deadband and well inside the transmitter’s own stated accuracy over its calibration interval.

IEC 61511-1:2016 clause 11.9 addresses proof testing and the need to detect dangerous undetected failures. The standard does not prescribe a specific drift limit, but it does require that the proof-test interval and method are justified against the failure modes of the device. A proof test that only checks the transmitter at one point — typically 4 mA and 20 mA — does not exercise the span linearity across the range. It confirms the endpoints, not the gain.

Diagnostic coverage and proof-test method

IEC 61511-1:2016 clause 11.9.2 and the diagnostic coverage definitions in IEC 61508-2:2010 Annex A give the framework. Diagnostic coverage is the ratio of detected dangerous failures to total dangerous failures. A transmitter with no internal diagnostics beyond a watchdog timer has low diagnostic coverage for drift. A smart transmitter with internal reference monitoring can claim higher coverage, but only if the diagnostic actually detects the drift mode and only if the claim is supported by failure data.

The practical method for drift is a proof test that exercises the span. For a differential-pressure flow loop, that means applying at least three test pressures across the calibrated range — typically 0%, 50% and 100% — and comparing the indicated flow against the reference. A two-point check at 0% and 100% confirms zero and span but not linearity. A three-point check catches a span shift that is not linear, which is common in diaphragm-based transmitters after thermal cycling.

For a control valve on a SAG mill feed line, the equivalent is a partial-stroke test that measures actual travel against commanded travel at multiple positions, not just open and closed. Valve positioner drift changes the installed characteristic, which changes loop gain in the same way a transmitter span shift does. The trip function on a high-level or high-pressure loop depends on the valve reaching a defined position within a defined time. If the positioner has drifted, the time changes.

What to do with the result

Proof-test records should log the as-found value, not just pass or fail. A transmitter that reads 4.18 mA at zero is not a failed device under most acceptance criteria, but it is a data point. Trending as-found values across proof-test intervals shows the drift rate. If the rate is 0.5% per year and the trip setpoint margin is 2%, the proof-test interval is defensible. If the rate is 2% per year, the interval is not.

IEC 61511-1:2016 clause 11.9.3 requires that the proof-test interval is based on the failure rate data and the required integrity. For drift-dominated failure modes, the failure rate is not a constant. It is a function of the calibration interval and the environment. Thermal cycling, vibration and process fluid contact all accelerate it. A transmitter on a vibrating conveyor drive gearbox enclosure will drift faster than one in a temperature-controlled analyser house.

The Ontario asset sale reported by MINING.COM on 9 October 2026 — McEwen’s $55M divestment to fund gold growth — is a reminder that capital cycles move. Brownfield sites change ownership, maintenance regimes change, and calibration records do not always transfer with the asset. A loop that was proof-tested on a two-year interval under one owner may be on a four-year interval under the next. The drift rate does not change because the ownership did.

Getting started

Pick three loops with a safety function and a transmitter or positioner in the loop. Pull the last four proof-test records. If the records only show pass or fail, the as-found data is missing and the drift rate is unknown. Add a three-point span check to the next proof test and log the as-found values. Compare the drift rate against the trip setpoint margin. If the margin is less than twice the annual drift, shorten the proof-test interval or add a diagnostic that detects the drift mode. Document the basis in the safety requirements specification. The alarm will not tell you the gain has moved. The proof test will.

Grounded in a verified live source: McEwen’s $55M Ontario asset sale fuels gold growth plans (2026-10-09) — source: live-verified.

Talk to S5 System about your site

S5 System designs and manufactures ultra-low-power industrial IoT sensors for mining, agriculture, infrastructure and utilities.

Discuss your IoT monitoring project — book a call.