Diagnosing Live-Zero Failures and Missing High-High Interlocks During Sensor Power Loss in CEMAT C_MEASUR

In SIMATIC PCS 7 CEMAT installations utilizing the C_MEASUR (C_MEASURE) analog monitoring block for temperature and pressure instrumentation, the dangerous failure where a field sensor power loss or RTD short-circuit drops the measured input to live-zero (e.g., 0 mA / 0.0 °C) without asserting high-high (HH) temperature shutdown interlocks occurs because the block's trip interlock is configured strictly on an upper threshold comparison (PV >= HH_Lim). When power is lost, the input drops below LL_Lim rather than exceeding HH_Lim. To guarantee equipment protection against sensor loss or electrical shorts, engineers must interconnect the block's channel fault output (QBAD / ST = 16#00), low-low limit (LL_Act), or wire-break diagnostic bits into the plant trip interlock logic, ensuring fail-safe de-energization upon signal loss.

Architecture of Analog Measurement Processing in CEMAT C_MEASUR

The C_MEASUR (FB1006 / C_MEASURE) block is the standard analog value acquisition and limit supervision block in the SIMATIC PCS 7 CEMAT (Minerals Automation Standard) library. It processes raw integer words from analog input cards (e.g., SM 331, SM 336), scales them to engineering units (e.g., 0.0 to 200.0 °C), applies smoothing filters, and evaluates four configurable limits:

HH_Lim (High-High Limit): Critical upper trip threshold (e.g., motor bearing over-temperature trip).
H_Lim (High Warning): High pre-warning.
L_Lim (Low Warning): Low pre-warning.
LL_Lim (Low-Low Limit): Critical lower trip threshold.

Root Cause Analysis: Why Field Power Loss Fails to Trigger High Interlocks

In heavy industrial equipment (such as kiln drive bearings, crushers, or ball mill trunnions), over-temperature is the catastrophic failure mode. Engineers frequently program the motor shutdown interlock to trip ONLY if HH_Act = 1:

The Short-Circuit / Power Loss Trap: When a 24V DC loop power supply fails, a field terminal shorts to ground, or an RTD sensor lead breaks on certain transmitter types, the electrical signal drops to 0 mA (or into the negative underflow zone, e.g., -32768 counts / 0.0 °C).
Logic Blind Spot: Because 0.0 °C is mathematically lower than a 95.0 °C HH_Lim, the block evaluates HH_Act = 0 (No High Alarm). If the trip logic does not evaluate sensor validity, the DCS assumes the bearing is operating at a perfectly safe low temperature, allowing the mechanical equipment to run until catastrophic seizure.

The 4-20 mA Live-Zero Principle and Wire-Break Detection

Standard industrial current loops utilize 4 mA—rather than 0 mA—to represent the bottom of the measuring scale (the 'Live Zero'):

Normal Operating Range: 4.0 mA to 20.0 mA represents 0% to 100% of engineering range.
Underrange / Sensor Fault: Signal levels between 3.6 mA and 3.8 mA represent sensor drift.
Dead Zero / Wire Break: Any current below 3.6 mA (especially 0.0 mA) indicates a severed cable, blown fuse, or short-circuited transmitter. Modern analog cards flag this condition as a hardware fault in the diagnostic byte.

Configuring Fail-Safe Interlock Logic for Sensor Faults

To ensure continuous protection against sensor failure in CEMAT:

Evaluate Channel Quality (QBAD): In CFC, connect the channel driver's bad quality output (Pcs7AnIn.Bad or CEMAT raw status) into the drive's protection interlock (C_DRV_1D.IntProt1). If sensor quality fails, the drive must trip.
Utilize Low-Low Limits (LL_Lim): Set LL_Lim to a realistic physical floor (e.g., -10.0 °C for outdoor bearing monitors). If the sensor drops to 0 mA, LL_Act asserts true. Wire LL_Act as a trip condition.
Substitute Value Strategy: On the input driver block, configure parameter SubsVal = 999.0 with SubsData = 1. If the sensor fails, the driver automatically forces the process value to 999.0 °C, instantly triggering HH_Act and halting the machinery.

Comparison of Sensor Fault Response Configurations in CEMAT

The following table compares different trip logic designs when a sensor loses power:

Interlock StrategyCondition on 0 mA Sensor Power LossDrive ResponseSafety Integrity LevelNaive Upper Limit Only (HH_Act)Process Value = 0.0 °C; HH_Act = 0Drive Keeps Running (Catastrophic Risk)Dangerous / Non-CompliantCombined Limit + Quality (HH_Act OR Bad)Bad = 1; HH_Act = 0Drive Trips ImmediatelyRecommended Industrial PracticeSubstitute High Value (SubsVal = 999.0)Process Value = 999.0 °C; HH_Act = 1Drive Trips on High AlarmExcellent Fail-Safe BehaviorLow-Low Interlock (HH_Act OR LL_Act)Process Value = 0.0 °C; LL_Act = 1Drive Trips on Low-Low Sensor FaultStandard Process Interlock

Verification

Verify sensor fault protection in CFC and WinCC Runtime:
1. While the drive is running in simulation or test mode, disconnect the field analog input wire or force the raw input word to 16#7FFF (Wire break / overflow) or 16#8000 (Underflow).
2. Confirm that C_MEASUR sets the fault status bit and displays a yellow/red diagnostic strike-through on the WinCC faceplate.
3. Verify that the drive protection interlock trips instantly, commanding C_DRV_1D.Ctrl = 0 and opening the main contactor output.
4. Verify that WinCC Alarm Logging displays both 'Sensor Wire Break / Channel Fault' and 'Drive Tripped on Protection Interlock'.

Limitations and Operational Precautions

When using substitute values (SubsVal = 999.0), be aware that historical trend logs will record an artificial spike to 999.0 °C during sensor maintenance, which can skew monthly statistical averages unless filtered. In critical plant machinery where a single sensor wire break would cause millions of dollars in unnecessary production downtime, implement 1oo2 or 2oo3 dual-sensor voting using standard APL voting blocks (MuxAn08 or safety voting blocks).

Engineer FAQ

Why did C_MEASUR show 0.0 instead of triggering an alarm when the wire broke?

Because the block was only looking for high temperature (HH_Lim). A wire break drops current to 0 mA, resulting in a minimum scale reading (0.0). If you do not monitor QBAD or LL_Lim, the system sees 0.0 as safe.

What does the live-zero concept mean in industrial 4-20 mA loops?

Live zero means that 4 mA represents zero process units. This allows the DCS to immediately distinguish between a true zero reading (4 mA) and a broken wire or power failure (0 mA).

How do I configure C_MEASUR to trip on wire break?

Interconnect the channel driver's Bad (or QBAD) output through an OR gate with the high-high limit output HH_Act into the drive's protection interlock input.