At a UK chemicals site, a thermocouple on a key product stream read 2 to 3 degrees Celsius low for approximately six weeks. It remained inside the configured alarm limit, so no alert was raised. Operators adjusted process targets around the reading, unaware that drift was driving the change. Scheduled maintenance recalibration showed the true stream temperature was outside the downstream separation column's safe operating envelope. Six weeks of historian data could no longer be trusted, and the plant had operated beyond its safety case parameters without the operations team knowing.
Why drift is harder to spot than sensor failure
A completely failed sensor is relatively clear. Its value reaches zero, hits a limit, or carries a bad-quality flag, prompting the DCS to raise an alarm. Drift gives a credible-looking reading. It develops slowly, avoids rate-of-change alarms, and initially remains within configured limits. Operators gradually revise their sense of normal around the value they see, without recognising that the reference itself has moved.
In high-temperature processes, thermocouple drift commonly results from sustained heat gradually changing the wire alloy's thermoelectric properties. Deposits in impulse lines can make a pressure transmitter's apparent zero point move. Fouling can slowly shift a flow meter. For pH electrodes, drift is associated with reference junction degradation and membrane fouling. These failure modes leave different statistical signatures, but all can remain invisible to threshold alarms until the measurement crosses a configured limit.
How drift travels through the process
The hazard is less the drift itself than the downstream response it prompts. A flow meter reading 5% low can lead an operator to change a downstream ratio controller setpoint to preserve the apparent stoichiometric ratio. For weeks, the controller compensates for bad input. Once recalibration restores correct flow data, the loop still has incorrect setpoints, and the process may leave its normal range before operators can react.
This is why sensor drift appears so often in process safety incident analysis. The initiating fault is gradual and small; the control system then responds rationally to incorrect data. When the operator sees the problem, they are usually seeing weeks of compensation across several control layers, not the original drift. The causal chain is easy to reconstruct afterwards, but much harder to identify prospectively.
The engineering tools for finding drift
The tools are established: control charts, CUSUM algorithms, cross-validation of redundant instruments, and material and energy balance checks. The practical constraint is continuous application at scale, not a lack of available methods.
At a site with 5,000 instrumented points, no process engineer can watch CUSUM charts for every measurement. Sites generally use maintenance management system calibration intervals, plus ad hoc investigation when an operator spots an inconsistency. Those intervals reflect manufacturer specifications and historical experience for an instrument type in a service, rather than real-time evidence of how one instrument is performing under current conditions.
The result is a predictable gap. An instrument degrading faster than expected may escape detection until its next calibration, weeks or months later. One performing better than expected uses calibration capacity unnecessarily. Fixed intervals cannot tell these cases apart, and most sites cannot adjust them dynamically from observed drift behaviour.
How cross-validation changes detection
The most dependable approach we have used is cross-validation, rather than processing an individual sensor stream alone. Redundant measurements, material balances, and process-model predictions provide a reference against which a potentially drifting instrument can be tested.
Suppose three redundant thermocouples measure a vessel. Two agree within 0.5 degrees Celsius, while the third reads 2 degrees higher. The third is almost certainly drifting, even if every value remains within its alarm limit. Likewise, sustained disagreement between a flow meter and a mass balance beyond normal measurement uncertainty points to drift in one balance input. The key is calculating these relationships continuously, rather than checking them manually during an investigation.
The difficulty is performing these checks in real time and at scale. A plant with hundreds of separate material and energy balance relationships cannot maintain them by hand. This is where machine learning has a useful role: building and updating models that produce cross-validation reference values, then identifying when a sensor diverges from the value predicted under current process conditions.
What an early drift signal looks like
We ran Offset against historian data from a refinery pilot, looking for drift signals that would have appeared before calibration eventually found the condition. Across a six-month dataset, three cases showed cross-validation divergence five to fourteen days before scheduled calibration. In two of those three cases, operators changed control setpoints between drift onset and calibration, consistent with compensating for a low-seeming reading without recognising drift as the cause.
We are cautious about the implication. These cases do not show that detection would have prevented incidents: the sites operated safely, routine maintenance included the calibrations, and the impact was limited to degraded measurement quality. They do show that the delay between onset and detection is measurable in historical data, and that cross-validation can reduce it where redundancy or balance relationships are available.
Responding to a drift alert
An early drift signal is neither a setpoint instruction nor permission to override alarm management. It tells the instrument engineer to inspect the point and consider moving its calibration forward. Operations should continue with current setpoints while the check takes place, rather than compensating for suspected drift before confirming it. Acting on an unconfirmed correction can compound the original error.
Offset's role ends at producing evidence that a particular instrument merits early inspection: a divergence score, deviation from predicted values, how long the deviation has developed, and supporting signals from related measurements. The instrument engineer decides whether to remove the point for inspection, continue operating while advancing calibration, or compare it with a portable reference without taking it offline. That decision depends on measurement criticality in the current context, the device's reliability history, and the plant's ability to interrupt service.
Drift detection as instrumentation health intelligence
Viewing drift events one at a time hides what continuous monitoring reveals about the wider instrument population. A rise in drift frequency may mean calibration intervals became too long after a process change, or that current conditions are accelerating degradation for a particular instrument type or service class.
The longer-term management question is not only, "Is this sensor drifting today?" It is also, "Are sensors of this type and service, under these conditions, drifting at twice the rate assumed when we set maintenance intervals?" Reliable drift data lets operations teams adjust schedules based on evidence instead of static manufacturer intervals written for generic service.
That benefit stands apart from whether any single drift would have caused an incident. It builds over months and years through better calibration planning and a clearer operating picture. Catching one drift early has value. Changing the interval so the next ten are not missed has more.