559

3.9 Transmitters: Self-Checking and Self-Validating

J. BERGE (2005)

Communications Transmitters with 4- to 20-mA output shall conform to NAMUR NE-43 HARTInfrastructure handheld such as the Smar HPC301 (about U.S. $1000)(Permanently FOUNDATION fieldbus host such as Smar SYSTEM302 (from U.S. $4000)Connected):

Costs (Typical base Microprocessor-based 4 to 20 mA, such as SMAR LD290, U.S. $500prices for pressure HART, such as SMAR LD301, U.S. $700transmitters): FOUNDATION Fieldbus, such as SMAR LD302, U.S. $800

Suppliers: Refer to Sections 3.6, 3.7, and 3.8 in this volume and to Volume 1 of this handbook.

INTRODUCTION

Self-diagnostics are of great importance for both operationand maintenance. Self-diagnostics are important because thereliability of the measurements is essential for proper control.Control and alarm systems using invalid inputs are a safetyhazard. Measurement validation is therefore paramount. Indi-cations of invalid measurements can be used to shut downthe loop or to activate backup systems.

Conventional and more sophisticated software tools suchas statistical process control (Section 2.34), model-based pre-dictive control (Section 2.14), and optimization (Section 2.20)should all work only with validated data and must knowwhether a measurement is invalid.

Until recently only two types of maintenance strategieswere used in the processing industry: reactive maintenance (itsresponse is usually too late) and preventive maintenance (tooearly). Both are costly and ineffective. The recommendedmaintenance scheme is a proactive one, which responds to theactual device status.

Such condition-based maintenance strategies rely on self-diagnostics to report on the health of field instruments to anasset management software system. Self-diagnostics detectand immediately signal the failure of a device. Diagnostics inconjunction with appropriate means of communication andadvanced software tools permit remote troubleshooting.

Measurement validation is also critical in the proper oper-ation of safety control systems. This requirement resulted ina trend that because switches provide no diagnostics, low-cost transmitters are taking their place in critical applications,where self-diagnostics are used.

LEVELS OF DIAGNOSTIC INFORMATION

Self-validation methods vary by both the type of measure-ment and by the supplier involved. In the past, most trans-mitters only had a single general failure indication for allfaults. Todays transmitters, however, increasingly providedetailed diagnostics. The level of diagnostics available variesgreatly by manufacturer.

Indeed, some transmitters are equipped to provide diag-nostics that go down to the chip level, even if repair can onlybe performed at the board level. Because component levelrepairs are currently rare and are subject to approval fromboth a certification agency and the manufacturer, for mostpractical purposes, board-level diagnostics are sufficient.

Transmitters have diagnostics for the transmitter itself, i.e.,the main circuit board, as well as diagnostics for its sensor orsensors. Transmitters can be categorized into two groups withrespect to the sensor: those with integral sensors such as mostpressure, flow, and level transmitters, and those with externalsensors such as most temperature, pH, conductivity, etc.Devices without microprocessors have no diagnostics at all.

How Diagnostics Are Performed

Self-diagnostics of transmitters are active when the power sup-ply is on. When this is the case, the integrity of data in thedifferent nonvolatile memories is checked to ensure that theyhave not been corrupted (Figure 3.9a). Memory checks are alsoperformed periodically while the device is in operation. Otherdiagnostics include consistency of configuration and calibra-tion. If a device is in simulation mode, this is also reported bythe diagnostics software.

2006 by Bla Liptk

560 Transmitters and Local Controllers

Many types of device failures can manifest themselves insimilar ways and it may not be possible to distinguish amongthem. Moreover, a failure of the main circuit board often resultsin the failure of a local display and communication channel,thereby making easy diagnostics impossible. Therefore, theuser may not know exactly what is wrong with the sensormodule. However, it suffices to know that the main circuit andnot just the sensor module has failed because the main circuithas to be replaced in either case. Detailed analysis can beperformed once the faulty circuit board has been replaced.

Transmitters with Integral Sensors Transmitters with inte-gral sensors continuously check the sensor signal and com-pare it to expected readings to detect abnormal conditionsbased on manufacturer experience with the particular mea-surement method used. Pressure, level, and flow transmittersare all available with integral sensors. In order to allow foreasier repair, the sensor is usually detachable from the maincircuit board (Figure 3.9b).

The device or its sensor module provides temperaturemonitoring for temperature compensation of the measurementin addition to registering the violation of temperature limits.If a low limit is violated, this can be used to alert operatorsthat the process fluid may be solidified or frozen and thereforethe operation of the heat tracing system should be checked.Similarly, if a high-temperature limit is violated, it is desirableto check whether the sensor has been affected, degrading itsaccuracy or requiring recalibration. Such condition monitoringis required for proactive maintenance, which can ensure thatsmall transmitter problems are corrected before they can causelarge plant problems.

The symptoms of several types of sensor failures aresimilar and may not be distinguishable. For example, theleaking of pressure sensor diaphragms caused by corrosion

FIG. 3.9aDiagnostics are performed by CPU firmware in conjunction with sensors application specific integrated chips (ASIC).

Sensor module

Oscillator

PressureSignal

isolation

SensorEEPROMmemory

Powerisolation

Temp

Main circuit board

Localadjust

PROMmemory

CPUEEPROM

RAMMemory

Math co-processor

D/Aconverter

HARTmodemdisplay

controller

Outputand

powersupply

Display

FIG. 3.9bPressure sensor module contains application specific integratedchips (ASIC) that handle diagnostics. (Courtesy of SMAR.)

2006 by Bla Liptk

3.9 Transmitters: Self-Checking and Self-Validating 561

may result in the same symptoms as some other type of sensorfailure. In this case, the user may not know exactly what iswrong, but it suffices to know that the problem is with thesensor module and not the main circuit board and thereforethe sensor has to be replaced. Detailed analysis can be per-formed after the faulty sensor has been removed. What ismost important is to know that it was indeed a genuine sensorfailure and not some kind of process upset or blocked impulseline that created the indication of failure.

Transmitters with External Sensors Transmitters utilizingexternal sensors include temperature, pH, and conductivityas well as several other types. A self-diagnosing transmitterperiodically checks the external sensor to determine its healthas well as checking the integrity of the wiring. A variety oftests can be performed, depending on the measurements andon the type of the primary sensor.

For example, in the case of thermocouple-type (TC) tem-perature sensors, the test may involve the sending of currentthrough the leads to verify the continuity of the wires and todetect burn-out of the TC junction. Another test is to checkthe plausibility of the cold-junction temperature sensor reading.

For an RTD (Resistance Temperature Detector) sensor,the transmitter may measure the resistance of the individualsensor wires because excessive resistance can signify pooror wrong connections. Furthermore, the transmitter may con-tain internal comparison circuits, which can detect drift in itsown internal secondary measurement circuitry.

More expensive but also more comprehensive diagnosticscan be provided if two temperature sensor elements are used.If their readings excessively deviate from each other, that isused as an indication of failure.

pH is a notoriously difficult measurement and is perhapsone of the best examples where good use can be made of mea-surement validation. A modern pH transmitter (Figure 3.9c)continuously monitors both the measurement and the ref-erence electrodes to detect mechanical damage of the sen-sor, contamination or blockage of the diaphragm, and aging

or defects in the cabling. As a means to support proactivemaintenance, the transmitter may even include a timer thatalerts the operator when it is time to recalibrate. Further-more, the transmitter may contain internal gain check todetect drift in its own internal secondary measurementcircuitry.

DIAGNOSTICS TRANSMISSION

The output signal of a transmitter can indicate its own healthand the validity of its measurement. In case of analog transmit-ters, if the output is outside the normal operating range, thatusually signals some type of failure. Intelligent transmitter com-munication indicates the status by using codes and parameters.

Analog Transmitters

Transmitters without microprocessors have practically noreal diagnostics capability. However, thermocouple temper-ature transmitters may still have a pull-up resistor thatprevents the input from floating in case of thermocoupleburnout, which otherwise can drive the output to either ofthe following extremes: above 20 or below 4 mA.

Other analog transmitters work in a similar fashion. Thisscheme of protection is available for live zero signals suchas 4 mA or 1 V, but for dead zero (zero-based) signals, thescheme does not work because it is usually not possible togo below 0 mA or 0 V. In these cases, an output that is below1% is usually considered to be a failure indication.

Microprocessor-Based Transmitters

Microprocessor-based transmitters with 4- to 20-mA outputand with or without highway addressable remote transducers(HART) have sensor diagnostics and can manipulate theiroutputs intelligently.

The NAMUR NE-43 (Normen-Arbeitsgemeinschaft frMe-und Regulungstechnik in der Chemischen Industrie)standard defines the signal levels that indicate the health ofinstruments (Figure 3.9d).

To indicate that the measurement is Good, the transmitteruses a signal in the range 4 to 20 mA. The wider range of 3.8to 20.5 mA indicates that the measurement is outside the setrange but probably still useful. This status may be consideredUncertain. If the signal is between 3.6 and 3.8 mA or between20.5 and 21 mA, the transmitter is Bad. So, when the signalrises higher (20.5 to 21 mA) or drops lower (3.6 to 3.8 mA), aset of user-defined safety actions should be initiated.

HART Transmitters HART (highway addressable remotetransducer) transmitters are smart instruments (see Section 4.11in Volume 3 of this handbook) that provide slow digitalcommunication in addition to their simultaneous 4- to 20-mAanalog signals. The device status is included in all theircommunication responses.

FIG. 3.9cSelf-checking pH transmitter. (Courtesy of Mettler-Toledo.)

2006 by Bla Liptk

562 Transmitters and Local Controllers

Because HART is relatively slow, the control loops relyon the 4- to 20-mA analog signal for control. Therefore, inmost installations the HART communication capability is onlyutilized occasionally, by connecting a handheld tool. There-fore, in most plants the HART device rarely communicates themeasurement validity digitally. Consequently, when the HARTcommunication is not continuous it is even more importantthat the control system should detect any fault indication by

the analog signal from the transmitter and bring it to the atten-tion of the operator (Table 3.9e).

However, in such control systems where the communi-cation is always on and continuously polls the transmitters,a faulty sensor is reported instantly. In order to provide thismode of operation, it is necessary that the DCS/PLC systemsuse input modules with HART communication or an auxiliaryHART multiplexer.

Foundation Fieldbus Transmitters Foundation Fieldbus trans-mitters are intelligent instruments (see Section 4.12 in Volume 3of this handbook) with pure digital communication. Fieldbuscommunication is always on. The health of the device andthe validity of the measurement are continuously communi-cated. The extensive diagnostics capabilities and the abilityto effectively report the health and measurement validity ofthe transmitted data are among the primary reasons for choos-ing Fieldbus.

In addition to the diagnostic and validity information listedin Table 3.9f, every transducer block has detailed diagnostic

FIG. 3.9dA failure indication recommendation by a German standard,NAMUR NE-43 (Normen-Arbeitsgemeinschaft fr Me-und Regu-lungstechnik in der Chemischen Industrie).

TABLE 3.9eDescriptions of HART ErrorsError Description

Field Device Malfunction The device has failed. The measurement is invalid.

Configuration Changed The device configuration has been changed, possibly affecting the measurement.

Cold Start The device has restarted.

More Status Available Additional detail status about the device health or measurement validity is available.

Analog Output Current Fixed The device is in simulation mode. Output does not reflect measurement.

Analog Output Saturated The output is out of range. The output does not reflect the measurement.

Nonprimary Variable Out of Limits

Auxiliary measurement, e.g., sensor temperature, is out of range. The measurement may be uncertain.

Primary Variable Out of Limits The measurement is out of range. The output does not reflect the actual value.

Set range

Output currentFailure

Saturated

FailureSaturated

3.63.84.0

20.020.521.0

Applied input

TABLE 3.9fDiagnostics and Validity Information Provided by FieldbusTransmitters

Parameter Description

*.status All input and output parameters, including the measurement, as well as some contained parameters have a status associated with the value (see Table 3.9g)

BLOCK_ERR All blocks have a summary of faults. In the resource block, this parameter reflects the health of the device as a whole. In the AI block, it represents the associated measurement (see Table 3.9h).

XD_ERROR All transducer blocks have more detailed information about the fault.

MODE_BLK All blocks have a mode. If the actual mode of the resource block does not match the target mode, this is an indication of some sort of problem with the device as a whole. If the actual mode of a transducer block does not match the target mode,this is an indication of aproblem with the associated measurement.

RS_STATE The resource block indicates the overall health of the device. If it is failure, the memory or other hardware has a fault.

2006 by Bla Liptk

3.9 Transmitters: Self-Checking and Self-Validating 563

parameters that are specific for the particular transmitter type,technology, and manufacturer.

The BLOCK_ERR parameter is found in all FOUNDATIONFieldbus function blocks. It gives a summary of all faults inthe device (Table 3.9h).

DIAGNOSTIC INFORMATION DISPLAYS

The fact that a transmitter failed or that it needs attention mustbe indicated both locally and in the control room in order tobring this information to the operators attention. Fieldbus andHART configuration tools allow for effective management offailures, as was discussed in Section 1.6 of the first volume ofthis handbook.

The local indicator on the transmitter can display status,such as Bad, and can provide direct failure messages, suchas sensor burnout, both textually (Figure 3.9i) and symbol-ically (Figure 3.9j).

Health indication is very helpful for troubleshooting inthe field. For this reason it is a good idea to use transmittersthat are provided with local digital displays.

Usually, the operator in the control room is the first tonotice that invalid measurements or transmitter failures haveoccurred. In order for the total process of transmitter self-checking and validation to be fully effective, the chain, con-sisting of failure detection in the transmitter, transmission ofthat information to the control system, and its presentationfor the operators, must be fully integrated (Figure 3.9k).

In addition to the displaying of the status on the faceplate,any Uncertain or Bad status should also be logged and alarmed.Once operators detect an invalid measurement they can initiatethe process that will determine the actual cause.

OPC (Object link embedding for Process Control) is akey technology serving to get data to the operators worksta-tions in the control room. This software architecture wasdescribed in Section 5.4 of the third volume of this handbook.It is recommended to use OPC in conjunction with HARTor FOUNDATION Fieldbus.

Portable and Handheld Displays

On the displays of handheld tools, technicians can see thedetailed diagnostics of the transmitter. In the case of HART

TABLE 3.9gFieldbus Measurement Status Attributes and Their Descriptions

Status Attribute Description

Quality The validity of the measurement value may be Good, Bad, or Uncertain. There are two forms of Good; the one associated with measurements is Good (Noncascade).

Substatus Additional details hinting why the quality is Bad or Uncertain. For Good it contains alarm summary or other information used by the internal workings of the block.

Bad Nonspecific

Configuration error Some parameter is incorrectly configured.

Not connected Input is not linked.

Device failure Output has failed.

Sensor failure Sensor has failed.

No communicationlast usable value

Input is not being received. The value remains since last communication.

No communicationwith no usable value

Input is not being received. No earlier value is available.

Out of Service The block is out of service.

Uncertain Nonspecific

Last Usable Value Input is disconnected. The value remains since earlier on.

Substitute The value is entered manually

Initial Value Value entered while in out-of-service mode.

Sensor Conversion Not Accurate Out of range or the sensor may have fouled.

Engineering Unit Range Violation Out of range.

Subnormal Auxiliary or redundant sensors have failed or are not in agreement

Limit condition The limit condition for the value may be either High, Low, Constant, or none at all. High, low, and constant mean that the measurement does not represent the actual value, e.g., due to over range.

2006 by Bla Liptk

564 Transmitters and Local Controllers

systems, the portable handheld tool is brought out into thefield and is connected at the transmitter (Figure 3.9l).

In a Fieldbus system the technician can drill down intothe transmitter the detailed diagnostics information that canbe helpful in the troubleshooting effort. Because the commu-nication in Fieldbus systems is always on, there is no needto locate and connect a handheld tool to obtain the diagnostics;

they are available from the engineering station at any time(Figure 3.9m).

FOUNDATION Fieldbus transmitters are provided with morediagnostics, and the information provided is easier to accessfrom the control room. These extensive diagnostics and theeffective reporting of measurement validity are primary rea-sons for choosing Fieldbus.

TABLE 3.9hTypes and Descriptions of Universal Fieldbus ErrorsError Description

Block configuration error One or more parameters are wrongly configured, preventing the block from operating properly. The measurement may be invalid.

Link configuration error One or more of the links for the block are wrongly configured.

Simulate is active (enabled) For the resource block this means that simulation is permitted for the transmitter inputs. In an analog input it means that the input is actually being simulated and does not represent the actual measurement.

In Local Override (LO) mode The block is in local override mode.Device fault state is forced Fail safe is forced in the device.

Device needs maintenance soon The predictive diagnostics in the device indicates that it may soon be in need of service. The device may e.g., require calibration, cleaning, or some other service.

Input failure The measurement has failed. The measurement may not be valid.

Output failure The output has failed.

Memory failure The device has a problem with one or more of its memories.

Lost static data The device has lost its configuration. The measurement may be affected.

Lost nonvolatile data The device has lost its configuration. The measurement may be affected.

Readback check failed The actual output may not match the desired output.

Device needs maintenance now The predictive diagnostics in the device indicates that is now in need of immediate service. The device may e.g., require calibration, cleaning, or some other service.

Powering up The device is starting up

In Out-of-Service (OOS) mode The mode of the block is set Out-of-Service.Others Additional device-specific status is available in other parameters.

FIG. 3.9i Failure message provided textually in a temperature transmitterdisplay. (Courtesy of SMAR.)

PV

FIG. 3.9j Failure message provided symbolically in a pH transmitter display.(Courtesy of Mettler-Toledo.)

2006 by Bla Liptk

3.9 Transmitters: Self-Checking and Self-Validating 565

To effectively manage large numbers of installed transmit-ters and other instruments, the Fieldbus and HART networkinfrastructure should be complemented with powerful onlineplant asset management (OPAM) software (Figure 3.9n).

If the asset management software is Web-based, themaintenance system can securely be connected to the enter-prise-wide intranet or the public Internet using appropriatefirewalls and other means of protection. This permits diag-nostics to be carried out from just about anywhere where itis possible to establish an Internet connection. For example,experts can access it from their homes, or access can begranted to the manufacturers support center.

ACTING ON THE DIAGNOSTIC DATA

It is not possible to control a process if the transmitted infor-mation is invalid or Bad. However, it may be possible tomaintain control while using uncertain measurements, suchas readings that are slightly out of range. In general, plantsafety is improved if transmitter self-diagnostics are utilizedto improve the validity of measurements.

Failsafe and Alarm Actions

Even the simplest analog control loop can be designed to failsafely. For example, in case of level control, a failsafe trans-mitter will generate a high analog output (say 21 mA), if thesensor fails. Therefore, the controller or alarm system willinterpret a 21-mA signal the same as if the tank is overfilledand thus will automatically close the filling valve.

Sophisticated DCS and PLC may interpret NAMUR NE-43 signal levels and thus determine if signal quality is Good,Uncertain, or Bad.

HART communication is too slow for closed-loop controlor shutdown interlocks and therefore both controls and alarmsutilize 4- to 20-mA analog signals.

Converters exist that can tap the HART communicationfrom the signal lines and can activate relays in case of failure.Such relays can tie to control systems, which do not com-municate HART but do need to know the transmitter status.

In a Fieldbus-based control system, safe loop action ispart of the IEC 61804-1 function block diagram language forbuilding control strategies, which is an integral part of theFOUNDATION Fieldbus system architecture. Values communi-cated between function blocks, such as from an analog input(AI) block in a transmitter to a PID block in a control valvepositioner, are accompanied by their status.

A Bad measurement status from the transmitter canautomatically switch the loop to a manual mode of operationor optionally, the PID control block can bring the controlvalve to its predetermined safe position (Figure 3.9o).

An advantage of the Fieldbus function block language isthat the interlocks are built into the control blocks. Thereforethere is no need to configure and validate additional logic toimplement the interlocks. Moreover, because Fieldbus is astandard, the interlocks work across all devices conforming

FIG. 3.9kOn the faceplate of the controller, next to the values of setpoint(SP), process variable (PV), and output signal, the letter Gdisplays the good status of the complete system.

FIG. 3.9l The transmitter diagnostics information, which is presented on aHART handheld tool display.

FIG. 3.9mThe transmitter diagnostics information, which is presented on aFieldbus software-supported display.

2006 by Bla Liptk

566 Transmitters and Local Controllers

to the standard. Therefore it is advisable to use transmitters,valve positioners, and central controllers that are based onthe FOUNDATION fieldbus blocks rather than using proprietary

languages. This can ensure that the measurement validity andother status information is propagated throughout the controlstrategy and not lost along the way.

Within the fieldbus PID block it is possible to set whetherthe status Uncertain shall be treated as Good or as Bad.This makes it possible to be selective when balancing pro-duction availability against plant safety on a loop-by-loopbasis. For loops that require high availability, an uncertainstatus is configured as good, thus permitting control to con-tinue under such conditions. For loops where safety is theprimary concern, the uncertain status can be treated as bad,thus shutting the loop down.

Reference

1. Berge, J., Fieldbuses for Process ControlEngineering, Operation,and Maintenance, Research Triangle Park, NC: ISA, 2002.

FIG. 3.9nTransmitter diagnostics using Web-based asset management (OPAM) software.

FIG. 3.9oStatus and operating mode propagation in a FOUNDATION TM fieldbuscontrol system, using function block language.

AI

IFS

PID AO

LOManBad

FSA

2006 by Bla Liptk

TABLE OF CONTENTSChapter 3.9: Transmitters: Self-Checking and Self-ValidatingINTRODUCTIONLEVELS OF DIAGNOSTIC INFORMATIONHow Diagnostics Are Performed

DIAGNOSTICS TRANSMISSIONAnalog TransmittersMicroprocessor-Based Transmitters

DIAGNOSTIC INFORMATION DISPLAYSPortable and Handheld Displays

ACTING ON THE DIAGNOSTIC DATAFailsafe and Alarm Actions

ReferenceA.1 International System of UnitsA.2 Engineering Conversion FactorsA.3 Chemical Resistance of MaterialsA.4 Composition of Metallic and Other MaterialsA.5 Steam and Water TablesA.6 Friction Loss in PipesA.7 Tank VolumesA.8 Partial List of SuppliersA.9 Directory of Lost CompaniesA.10 ISA Standards