Control-Valve Sticking Undetected by Flow-Loop Offset

A control valve that sticks does not usually fail to zero or fail to full travel. It fails in small increments. The stem hesitates at a position, breaks free under a slightly larger actuator force, and settles somewhere close to where the loop wanted it. The flow controller sees a small, persistent deviation between process variable and setpoint, trims its output, and the loop reaches a new equilibrium. The deviation is real, but it sits inside the deadband that the flow-loop alarm was configured to tolerate. The valve is degraded. The safety instrumented function that depends on that valve closing on demand is now compromised, and nothing in the control system has annunciated.

The mechanism: stiction, deadband, and offset absorption

Stiction is the force required to break the valve stem free from rest. It is distinct from deadband, which is the range of controller output over which the stem does not move at all. Both are present in every sliding-stem and rotary valve, and both grow with packing wear, stem galling, process deposits on the plug, and actuator diaphragm or spring degradation.

A flow loop tolerates a surprising amount of this. Consider a valve with 2 percent stiction on a 100 mm stroke. The controller output must move roughly 2 percent before the stem breaks away, then the stem jumps. The flow moves, the controller corrects, and the loop settles into a limit cycle whose amplitude is small enough to fall under the high/low deviation alarm threshold. The offset — the steady-state gap between setpoint and process variable — is absorbed by integral action. The controller output drifts to a new resting position that holds the required flow with the stem stuck where it is.

This is the detection gap. A flow-loop deviation alarm watches the process variable against setpoint. It does not watch the relationship between controller output and valve position, because on most installations there is no independent valve position feedback wired to the logic solver or even to the DCS historian. The loop is self-consistent. Flow is on setpoint. The alarm is silent. The valve is stuck.

The failure mode is progressive. Stiction that begins at 1 percent may reach 5 percent over a maintenance interval as packing compresses and deposits accumulate. Each increment is absorbed by the loop. The valve still moves, so a stroke test that only confirms “valve moved” passes. The degradation is invisible until the demand arrives — a trip, an ESD action, a shutdown sequence — and the valve fails to reach its safe position within the required response time.

Why this matters under IEC 61511

IEC 61511-1 treats a final element as part of the safety instrumented function, and the achievable safety integrity depends on the diagnostic coverage claimed for that element. A stuck valve is a dangerous detected or dangerous undetected failure depending entirely on whether a diagnostic exists that can see it. If the only diagnostic is a flow-loop deviation alarm, the coverage for the stuck-valve failure mode is close to zero, because the failure is masked by the loop’s own compensation.

The standard’s proof-test requirements in IEC 61511-1 clause 16 exist precisely because some failure modes cannot be detected online. A proof test must reveal failures that diagnostics cannot. For a control valve, a meaningful proof test is not a partial stroke that confirms movement. It is a test that measures the actual travel against the commanded travel, at the response time the safety function requires, and records the result against a pass/fail criterion.

Two numbers drive the test interval. The first is the assumed dangerous undetected failure rate for the valve, taken from the vendor data or from OREDA-style reliability data for the specific valve type and service. The second is the proof-test coverage factor — the fraction of dangerous failures the test actually detects. A partial-stroke test that does not measure full travel and response time has a coverage factor well below 1.0, and the interval must be shortened accordingly to hold the claimed integrity. Many operators run the interval against an assumed coverage factor of 1.0 and never verify it.

Diagnostic coverage that actually sees stiction

Online detection of stiction requires a signal that is independent of the flow loop. Three are defensible.

Valve position feedback. A position transmitter on the stem, compared against controller output in the logic solver or a dedicated asset monitor, exposes the output-to-position divergence that the flow loop hides. A persistent divergence beyond a configured threshold is a diagnostic for the stuck-valve failure mode. This is the highest-coverage option and the one most often absent on existing installations.

Actuator signature monitoring. Supply pressure and actuator output pressure, trended against command, show the pressure spike required to break stiction. A rising breakaway pressure over time is a leading indicator. This is a diagnostic, not a proof test, and its coverage factor must be justified in the safety requirements specification.

Loop performance monitoring. Oscillation detection on the controller output and process variable, using methods such as the Hagglund detecting-oscillation approach, can flag a limit cycle consistent with stiction. This is a lower-coverage diagnostic because it cannot distinguish stiction from tuning problems or external disturbances. It is useful as a trigger for investigation, not as a credited diagnostic.

Proof-test procedure

A defensible proof test for a safety-related control valve does the following, in order. It drives the valve to the safe position from the normal operating position, not from a mid-stroke parking position. It measures the time from command to confirmed safe position and compares it against the required response time in the safety requirements specification. It measures the actual travel against the commanded travel and records the deviation. It repeats the test in the opposite direction to expose asymmetry. It records breakaway pressure if instrumentation is available. It documents the result against a pass/fail criterion, and any valve that exceeds the travel deviation or response time is repaired before the SIF is returned to service.

The test interval is then set from the target failure measure, the assumed failure rate, and the verified coverage factor — not from a default annual schedule.

Getting started

Inventory every final element in a safety instrumented function and record whether independent valve position feedback exists. For each valve without it, document the current diagnostic coverage claim and the basis for it. Where the only diagnostic is a flow-loop deviation alarm, the coverage for stuck-valve failure is not defensible, and the proof-test interval must be shortened or the diagnostic added. Then write the proof test to measure travel and response time, not movement, and set the interval from the verified coverage factor.

Source: internal-backlog — grounded in S5 engineering design notes, not a current market event.

Talk to S5 System about your site

S5 System designs and manufactures ultra-low-power industrial IoT sensors for mining, agriculture, infrastructure and utilities.

Discuss your IoT monitoring project — book a call.