double sensor : which algorithm ?

To detect with certainty if you have two sensors drifting identically you should have at least five sensors. Then you may disregard the two highest values and the two lowest values. Because the system is important to safety the sensors should be gold plated to protect from corrosion. I will be glad to sell you the sensors.

If the sensors are of the live zero type like 4-20 ma. or 3-15 PSI, which is typical for procress sensors, you can distinguish if one has failed by going outside of the operating limits. If both are within the operating limits, you have nno information about which is correct.

Adding a third sensor is the usual method of obtaining information of an in range error.

Maybe if the sensors are of a different type/topology then the chance of them drifting identically is virtually zero...?

Del

A simple redundancy gives ONLY the information that one sensor is out of "range" but nobody can tell you which one. At least 3 sensors are required to use a "majority voting" procedure which assumes that the probability to have 2 sensors with exactly same drift is very low. So that by comparison the decision is taken according to the 2 sensors giving near to each other values and the 3rd sensor is declared as out of order. In critical systems as flight controls a redundancy of 4 is usual with the goal that even if a sensor fails there are still 3 for the majority voting.

A last remark all sensors have to be calibrated with respect to SAME reference.

This is a good discussion as it raises all sorts of questions....
I'm sure many of us have met situations where a perfectly good system shuts down because of an error/fault in the checking/safety/whatever system...

My preference is always for simplicity...I reckon two sensors is plenty, with an allowable margin of error between them. Duplicate the pair of sensors so that in the event of failure/disagreement the alternate pair can be switched in while the first pair are removed, tested/calibrated/ repaired.... whoops that's 4 sensors...damn it

Del

We are actually looking at this same problem. We have two sensors, but comparing them only tells you that one is wrong, not which one. We are left to try to intuit which is the failed sensor by reading tea leaves and such.

If one is taking digital readings one could look back to find the disscontinuity in one sensor...unless of course its a slow drift. And I s'pose I'm assuming a smoothly changing process . I'd have thought maybe taking the difference between each successive reading could be quite revealing.

I remember doing all sorts of weird stuff to detect 'start of breath' in a respiratory instrument...there was a noisey drifting noise floor and a signal which could start very sharply in a healthy individual but could be poorly defined in others...

hmmm.. maybe a nap would help?

Del

Define "critical", and "safety". If it is personel safety, then you either stick with one sensor (and shutdown to a safe state when bad), or you use 3 or more. Installing a 2nd sensor will give you an indication that the primary sensor could be bad, but you shouldn't rely on it to switch controls to the 2nd sensor.

For a less sensitive situation, you can do a confidence test on the sensors, and use that to switch controls. For example if the variable is flow, and there are times of zero flow, you can save the last x values at zero flow. By averaging those you can see which one has the greatest drift. By using the standard deviation you can spot if one is becoming erratic.

This is a common shutdown system design problem. let us look at IEC 61508. this depends on the SIL ( Safety Integrity Level) required by the safety engineering. you can use 2 out of 3 system on the transmitter/sensor side, you can use redundant I/O for each sensor on the system side, you can use redundant or triple modular reduandant processor, you can use a redundant software logic solver on the software side. it is long story, availability of the system should be studied and the required SIL should be defined.

Dr: Ahmed

This is a common shutdown system design problem. let us look at IEC 61508. this depends on the SIL ( Safety Integrity Level) required by the safety engineering. you can use 2 out of 3 system on the transmitter/sensor side, you can use redundant I/O for each sensor on the system side, you can use redundant or triple modular reduandant processor, you can use a redundant software logic solver on the software side. it is long story, availability of the system should be studied and the required SIL should be defined.

Dr: Ahmed

Thank you all

some more elements (definitions) :

This application is only a process control application, with some critical parameters to ensure quality of product. No human live impacted, only money. Process variations are slow (hours). Sensor potential drift is slow (months). Process can be stopped at any time. Sensors can be checked/calibrated/changed easily

I am thinking about a quite simple "double-sensor-situation", where I check in real time 2 things :

1. the difference A between the values

2. the distribution "difference" on a moving average (over for instance the last n x time constant of the process). Average ? standard deviation ? correlation between the 2 distributions ?

Only then I can take one of the 3 decisions I need :

1. do nothing

2. React on process

3. Alert because one of the sensors is potentially wrong (but I do not know which one), then stop the process, check the sensors apart, calibrate of change, and start again.

thanks

But your original statment included, "Only checking the difference between the sensors is clearly not enough (what happens if they drift identically ?)"

I still think you need five gold plated sensors.

what happens if they drift identically

Has anyone read #3 ??

Hi all & thanks for your feed-back

For several reasons I will double the whole measurement chain for one given parameter. Same model of sensor (same brand, same part number), same model of transmitter.

So the probability that they drift identically is the highest in that situation (compared for instance to sensors using a different physical law, coming from different suppliers)

So even if I can not estimate that "bad case" probability, I have the 'feeling' that it will lower the global probability to have a wrong measurement.

Right for you ?

Thanks

FL