The answer is: "It depends."
Most plants do not allow online downloading unless its absolutely necessary. That said, I did see one plant (a refinery) where online downloading was a routine practice and they had very few upsets when doing it. When downloading (some DCS manufacturers use the term "activating"), the risk comes during the first scan following the download. The pre-download process values can get..."lost" as the newly-modified function block comes up. With modern distributed control systems (DCS) where scan frequencies can be 100 msec or even less; it's just a fraction of a second. Take a look at the screenshot below as an example. This function diagram is on a Siemens T3000 DCS.
This is a 3 element drum level controller logic associated with a heat recovery steam generator (HRSG). I simply inserted one connector, between the Lead-Lag and CCTRL function blocks, and activated the change. The screenshot shows bad quality on 4 of the CCTRL inputs during the first scan after activation. If the unit were running; the concern would be on the drum level error (look for the yellow bad qualities) and Lead-Lag inputs to the CCTRL block on this first scan after the activation.
Now, with a scan frequency of 60 msec; there's probably miniscule risk, but you always need to ensure your process can handle any blind process value numbers from that first pass.
Now, here's my story: In September 2002, I'd repaired a logic error on my plant's HP Drum 3 element level controllers. I was the control room operator and was anxious to test my fix. The DCS was an Emerson DeltaV. The first unit was scheduled to come off line at 11 pm. At 10:30 pm, I received the call that I could slowly ramp the duct burners off over the next 15 minutes. I had the logic fix ready to go. I checked the HP Drum lo-lo-lo level trip to the gas turbine to verify it had an adequate time delay (3 seconds) and I placed the feedwater control valve in manual. I performed the download and immediately lost 30 MW of generation! Upon further investigation, I found the duct burners also had a lo-lo-lo level drum trip, but with no time delay. It was my fault and it illustrates the risk of online downloads.
You must always thoroughly research where the affected function block's signals go before performing an online download and take steps to mitigate the risk.
