Pump-Sump Level Drift Masked by Slow Sensor Response

A dewatering sump on a mine site is a simple vessel with an unglamorous job: collect inflow from floor wash, gland seal leakage, and seepage, then hand it to a pump before the level reaches the pump plinth. The control loop is equally simple — a level sensor, a pump starter, and usually a high-high trip or interlock to protect the pump and the surrounding decline. When that loop fails silently, it does not announce itself. It produces a slow, monotonic divergence between indicated level and true level that stays inside the normal operating band for weeks.

That divergence is the failure mode addressed here: **pump-sump level drift masked by slow level sensor response**. It is a functional-safety concern under IEC 61511, and it is routinely invisible to conventional alarm annunciation.

The mechanism: lag, not offset

Distinguish drift from lag. A drifting transmitter reports a value that is wrong but stable — a calibration problem, detectable by comparison against a second measurement. A slow sensor reports a value that is *late*. Under steady inflow, a first-order lag produces a constant offset proportional to the rate of change of true level. Under transient inflow — a wash-down cycle, a storm event, a burst hose — the offset grows with the rate of rise, and the indicated level can trail true level by a margin that scales with the disturbance.

The masking effect follows directly. High-level alarm setpoints are configured against indicated level. If the sensor’s time constant has degraded — diaphragm fouling, impulse-line partial blockage, a stilling well with restricted equalisation, ultrasonic head with condensation on the transducer face — the indicated level arrives late. The alarm still functions. It simply functions after the true level has passed the setpoint. In a sump with limited freeboard above the pump plinth, the interval between “alarm should have annunciated” and “pump cavitates or the plinth floods” may be shorter than the lag itself.

Slow response is therefore not a nuisance deviation. It is a systematic reduction in the time available for the safety function to act, and it is not detected by the diagnostics that most level installations actually run.

Why conventional alarms miss it

A high-level float switch or a conductive probe is a discrete device. It reports a state, not a rate. It cannot reveal that the continuous transmitter beside it is lagging, because the two instruments answer different questions. Where both are fitted, the discrete device usually sits at a higher elevation than the continuous alarm setpoint, so it only operates after the continuous alarm has already failed to act in time — and its operation is typically logged as a process upset, not as a diagnostic finding.

Loop-powered transmitters with onboard diagnostics report electronics faults, not process-interface faults. A fouled diaphragm or a partially blocked impulse line presents as a plausible, slowly varying signal. HART status remains good. The 4–20 mA signal stays in range. The DCS trend looks normal. Nothing in the control system has the information required to conclude that the measurement is late.

This is the gap that IEC 61511 addresses through diagnostic coverage and proof testing, and it is a gap in the *architecture of verification*, not in the instrument.

IEC 61511 framing: diagnostic coverage and proof test

IEC 61511-1 requires that the achieved safety integrity of a safety instrumented function be demonstrated, not assumed. Two mechanisms do the work.

**Diagnostic coverage (DC)** is the fraction of dangerous failures detected by automatic diagnostics. For an analogue level measurement in a dewatering sump, the credible dangerous failure modes are process-interface failures — fouling, blockage, coating, stilling-well restriction — plus the slow-response degradation described above. Onboard electronics diagnostics contribute to DC for internal failures. They contribute approximately nothing to DC for these process-interface failures. If the claimed DC for the level transmitter is carried into the SIL verification calculation without that distinction, the calculated probability of failure on demand is optimistic in exactly the failure mode that matters here.

The honest treatment is to state DC separately for internal and process-interface failure modes, and to assign the process-interface portion to proof testing rather than to automatic diagnostics.

**Proof testing** is where slow response can actually be found, provided the test is written to find it. A proof test that strokes a level loop by simulating a 4–20 mA input verifies the input card, the logic solver, and the final element. It does not exercise the sensor’s process interface and cannot reveal lag. A proof test that raises true level in the sump and times the response of the indicated signal to reach the alarm setpoint does exercise it. The measurable quantity is the loop response time against the design assumption used in the trip setpoint calculation.

Three practical provisions follow:

• **Record the assumed response time.** The setpoint calculation for a high-high trip depends on how long the loop takes to detect and act. If that number is undocumented, drift in it is undetectable by definition.
• **Test response time, not just trip point.** A step change in true level, with the time to alarm annunciation recorded and trended across successive proof tests, converts an invisible degradation into a measurable one.
• **Trend the trend.** A response time that moves from 4 seconds to 9 seconds over eighteen months is a finding, even if both values pass the acceptance criterion. The rate of change is the leading indicator.

Where a second, independent level measurement exists — a different technology, mounted to see the same vessel — comparison between the two provides continuous diagnostic coverage of the process interface. A float switch at a lower elevation than the continuous alarm setpoint, wired to a separate input, gives a discrepancy check that operates before the safety function is required to act. This is a design decision, and it belongs in the safety requirements specification, not in a commissioning afterthought.

Where this sits in the wider capital picture

The commercial context is not incidental. MINING.COM reported on 12 October 2026 that geopolitical risk is driving capital toward private-sector mining investment, with analysts framing the shift as a reallocation rather than a contraction (source: live-verified). Capital that moves toward private operators tends to move with tighter justification requirements attached. Instrumentation upgrades on dewatering sumps compete for funding against SAG mill relines, conveyor idler replacement, gearbox overhauls, and control valve refurbishment — all of which have visible failure consequences.

The argument for addressing pump-sump level drift is therefore not that it is the largest risk on site. It is that the fix is disproportionately cheap relative to the consequence. A documented response-time assumption, a proof-test procedure that measures it, and a discrepancy check against a second measurement cost far less than a flooded decline, a cavitated pump, or an unplanned dewatering outage during a wet season.

Getting started

1. Identify every sump in the dewatering circuit where a high-level trip or interlock protects a pump, a plinth, or a decline. List the level measurement technology and its mounting arrangement for each. 2. For each trip, locate the response-time assumption used in the setpoint calculation. If it does not exist, derive a defensible value and record it in the safety requirements specification. 3. Write a proof test that raises true level and times the interval to alarm annunciation. Record the result against the assumption. 4. Separate diagnostic coverage claims for internal transmitter failures from those for process-interface failures. Do not carry the former into the SIL verification calculation as though it covered the latter. 5. Where a second, independent level measurement is feasible, mount it to see the same vessel and wire it to a separate input for continuous discrepancy checking. 6. Trend response time across successive proof tests. Treat a consistent upward movement as a finding, regardless of whether the current value passes.

Grounded in a verified live source: Geopolitical risk drives capital to private sector: analyst (2026-10-12) — source: live-verified.

Talk to S5 System about your site

S5 System designs and manufactures ultra-low-power industrial IoT sensors for mining, agriculture, infrastructure and utilities.

Discuss your IoT monitoring project — book a call.