The short answer
Signal Validation
An analog input is validated by checking that it is within the range a healthy loop can produce, that the module reports the channel healthy, that it is changing when the process is, and that it is not moving faster than physics allows. When any check fails, the program marks the value bad, stops controlling on it, does something defined and safe, and alarms. A controller that keeps acting on a value it has no reason to trust is the most common way a good program does a bad thing.
Key points
- Range check against the NAMUR fault bands: below 3.6 mA or above 21 mA is a transmitter fault, not a measurement.
- Use the module status bits. They report open wire, under-range, and over-range without any inference.
- A value that has not changed at all for a long time while the process runs is frozen, and frozen is bad.
- A rate-of-change check catches a spike or a step that the process could not physically produce.
- On bad: hold or substitute according to the narrative, stop the affected control, alarm, and carry the quality to SCADA.
What can go wrong with a good-looking number
A 4 to 20 mA input that reads 12.0 mA is a plausible value for almost anything. It is also what a shorted loop, a frozen transmitter, or a stuck analog input channel can read. The program compares it with a setpoint and acts, and nothing in the comparison knows the number is a lie. Validation is the set of checks that give the program a reason to trust a value, or a reason not to.
The checks
- Range
- A healthy loop reads between about 3.8 and 20.5 mA, allowing for calibration and over-range. Below 3.6 mA or above 21 mA is the NAMUR NE 43 fault band, which a transmitter uses on purpose to say it has failed, and 0 mA is a broken wire. Compare the raw count, before scaling, against the counts for those currents from the module manual.
- Module status
- Diagnostic modules set bits for open wire, under-range, over-range, and channel fault. They are direct evidence and they should be the first thing the validation logic reads.
- Frozen value
- A live measurement of a real process changes, if only in the last digit. A value that has been exactly the same for minutes while pumps run and flows vary is frozen: a failed transmitter, a stuck channel, or a stale value from a communication link. Detect it by comparing the current value with the value some time ago, with a tolerance and a time window chosen for the signal.
- Rate of change
- A tank cannot fill in a second. A value that jumps by more than the process could move in one scan is a spike or a step from an electrical event. Flag it, and treat the previous value as current until the next reading agrees.
- Cross check
- Where two measurements should agree, a transducer and a float, two flowmeters in series, a pressure and a level, disagreement beyond a tolerance is a fault in one of them. It is the strongest check and the one that requires the most thought about which to believe.
What to do when it fails
A bad flag is only useful if the program does something with it, and what it does is a design decision written into the control narrative for each loop.
- 1
Stop controlling on the value.
A PID loop reading a bad measurement goes to manual at its last output, or to a defined safe output. A level control on a bad level falls back to floats or to a timed cycle. The narrative says which.
- 2
Substitute or hold.
Some loops hold the last good value for a limited time. Some substitute a fixed value that puts the process in a safe state. Some stop. Holding forever is the one option that is never right, because the process moves on while the value does not.
- 3
Alarm.
An instrument-failure alarm, distinct from the process alarm, so the operator knows the tank is not reading rather than that the tank is empty. Priority according to what the loop controls.
- 4
Carry the quality.
Set the tag quality bad in SCADA, so the value displays as bad rather than as a plausible number, and so the historian records the gap rather than a flat line.
- 5
Recover deliberately.
When the checks pass again, hold for a settling time before trusting the value, and consider requiring an operator acknowledgment before automatic control resumes on a loop that matters.
Keeping it maintainable
Validation written separately for every input becomes a program nobody can read. Write it once as a routine or a function block that takes the raw count, the status bits, the range limits, and the tolerances, and returns the value with a quality flag, and call it for every analog input. The tolerances then live in tags beside the instrument, documented with it, and a change to the method is made in one place.
Frequently asked questions
- What current means a transmitter has failed?
- Under NAMUR NE 43, below 3.6 mA or above 21 mA, which most transmitters use deliberately to signal a diagnostic failure. A broken wire reads 0 mA. Anything between about 3.8 and 20.5 mA is a measurement, possibly a wrong one.
- How long before a value counts as frozen?
- Long enough that a healthy signal would certainly have changed, which depends on the signal. A wet well level changes within a minute or two. A tank level at night might not change for ten minutes. Set the window per signal and the tolerance to a little more than the noise.
- Should the program hold the last good value?
- For a short time, while the fault is confirmed and the operator is alerted. Not indefinitely. The process keeps moving while the value does not, and a stale value that looks current is the most dangerous kind.
- Do I still need validation if the module has diagnostics?
- Yes. The module catches open wires and out-of-range currents. It cannot tell that a transmitter is frozen at a plausible value or that it disagrees with the float beside it. The status bits are the first check, not the only one.
Related topics
- Raw CountsWhat an analog input module actually hands the program: the count range, where 4 mA and 20 mA fall in it, how under-range and over-range show up, and why the module manual is the only source that counts.
- Filtering Analog InputsHow to damp a noisy analog input in the controller without hiding a real process change: the first-order filter, the moving average, the median, where each belongs, and what never to filter.
- 4-20 mA Signals from the Instrument SideHow a 4-20 mA current loop is powered and wired at the transmitter, why the loop resistance budget matters, and how to check a loop with a meter.
- Wet Well Level MeasurementHow lift station wet well level is measured, which technology suits which well, the failure modes that flood a station, and why the high level float must stay hardwired.
- Signal Pegged High or LowA 4-20 mA signal stuck at a rail or a fault current: a transmitter in fault, a process truly out of range, an open or shorted loop, a wrong range, a wiring error, an input channel fault, or a scaling clamp. How the current itself tells you which.
- 4-20 mA Current LoopsWhy the industry standardized on current instead of voltage, how a two-wire loop is powered, what the live zero buys you, and how to read a loop with a meter.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.