Implementing Frozen Analog Value Detection and Automatic Sensor Switchover in PCS 7 APL

In SIMATIC PCS 7 Advanced Process Library (APL), detecting a frozen or stuck analog temperature transmitter—where a sensor locks up and fails to update while the PID controller continues integrating—is implemented by constructing a dynamic rate-of-change or freeze monitoring circuit using standard APL blocks. The circuit compares the current analog sample with a sample delayed by one execution cycle using an analog comparator (CompAn02) or subtractor (Sub02). If the absolute difference between successive samples remains below a noise threshold for longer than a parametrized duration on a delay timer (TimerP), the timer asserts an alarm indicating a frozen sensor. This signal drives an analog multiplexer (Mux8_R) or selector (SelA02In) to immediately switch the PID controller's process variable (PV) to a healthy redundant transmitter.

Executive Summary

In critical thermal processes (such as chemical reactors, steam boilers, and distillation columns), temperature measurement transmitters occasionally lock up due to internal A/D converter latch-up, fieldbus communication buffer freezing, or mechanical sensor binding. Because the frozen value remains within nominal high/low engineering limits, standard out-of-range limit alarms (PV_AH_Lim, PV_AL_Lim) remain silent. The downstream PID controller continues integrating against the stale feedback, driving heating valves wide open and risking catastrophic thermal runaway. Constructing a dedicated freeze detection and automated switchover circuit using standard APL building blocks safeguards control stability without requiring custom SCL code.

Architecture and Fundamental Mechanics

The freeze detection and failover mechanism utilizes standard PCS 7 APL function blocks executing within a cyclic interrupt Organization Block (OB35):

The Freeze Detection Concept:
* Real-world analog temperature signals exhibit continuous microscopic process noise and thermal jitter. An analog reading that remains absolutely static (zero bit-level variance) over multiple minutes on an operating process is a definitive indicator of transmitter failure.
* By comparing the current value PV(t) against the value from the previous execution cycle PV(t - delta_t), the circuit measures absolute rate of change.
Block Interconnection Architecture:
* Sample Delay (SelA02In / Memory Storage): Stores the analog value from the prior execution slice.
* Comparator (CompAn02 or Sub02 + Abs02): Calculates |PV(t) - PV(t - delta_t)|. If this difference is less than an adjustable threshold epsilon (e.g., 0.01 deg C), the comparator output Out asserts TRUE.
* Duration Timer (TimerP): Configured as an On-Delay timer (Mode = 0 or On-delay). If the comparator remains TRUE continuously for duration Ti (e.g., 30 to 60 seconds), TimerP.Out asserts TRUE, indicating 'Sensor 1 Frozen'.
* Redundant Channel Selection (Mux8_R / SelA02In): Receives temperature inputs from Sensor 1, Sensor 2, and Sensor 3. When TimerP.Out asserts, it increments the selection index, seamlessly routing Sensor 2 to PidConL.PV.
2-out-of-3 (2oo3) Median Alternative (Med3_R):
* For installations with triple redundant temperature transmitters, the APL Med3_R (Median of 3) block calculates the median value. If one sensor freezes or drifts, the median algorithm automatically discards the outlier without requiring explicit timer interlocking.

Step-by-Step Implementation Procedure

Follow these procedures to build a frozen analog value detector and automated failover in CFC:

Instantiate Channel Drivers and Detection Blocks:
* In the CFC chart, place two or three Pcs7AnIn channel drivers corresponding to the redundant temperature transmitters (e.g., TT_101A and TT_101B).
* From the APL library, insert a Sub02 (Subtract), an Abs02 (Absolute value), a CompAn02 (Comparator), and a TimerP (Timer).
Configure Sample Comparison Logic:
* Connect Pcs7AnIn_A.PV_Out to Sub02.In1.
* Route Pcs7AnIn_A.PV_Out through a one-cycle delay block or discrete memory feedback to Sub02.In2.
* Connect Sub02.Out to Abs02.In to obtain the absolute delta |delta_PV|.
* Connect Abs02.Out to CompAn02.In1, and set CompAn02.In2 = 0.005 (the freeze noise threshold in deg C).
* Configure CompAn02 to assert when In1 <= In2 (delta is zero or negligible).
Configure Duration Timer (TimerP):
* Connect CompAn02.Out to TimerP.In.
* Set TimerP.Mode = 0 (On-delay timer).
* Set TimerP.Ti = 30.0 (30 seconds monitoring window).
* The output TimerP.Out represents 'Sensor A Frozen Alarm'.
Configure Automated Failover via Mux8_R or SelA02In:
* Insert a SelA02In (Analog 2-channel selector) before the PID controller.
* Connect Pcs7AnIn_A.PV_Out to SelA02In.In1 (Primary sensor).
* Connect Pcs7AnIn_B.PV_Out to SelA02In.In2 (Backup sensor).
* Connect TimerP.Out to SelA02In.Sel.
* Connect SelA02In.Out to PidConL.PV.
Configure Alarm Generation:
* Connect TimerP.Out to Pcs7AnIn_A.ExtMsg1 or an Event block to generate a WinCC alarm: 'Temperature Sensor TT_101A Frozen - Switched to Backup TT_101B'.
Compile and Download Changes:
* Compile the CFC chart with 'Changes only' and download to the AS controller in RUN.

Verification

Test the circuit in CFC test mode or S7-PLCSIM. Supply dynamic temperature oscillations to Sensor A; verify that TimerP.Out remains FALSE and SelA02In.Out passes Sensor A. Freeze the value of Sensor A (hold constant counts). After precisely 30 seconds, verify that TimerP.Out transitions to TRUE, SelA02In automatically routes Sensor B to PidConL.PV, and an alarm message appears in the WinCC alarm list.

Limitations and Operational Precautions

Ensure that the monitoring duration Ti is set significantly longer than the process dead time and natural temperature settling time under steady-state conditions to prevent false trips during stable operation. For batch processes where temperatures intentionally dwell at hold points, interlock freeze detection with heating power or flow circulation flags.

Engineer FAQ

Why did the PID controller runaway when the sensor froze?

A frozen PV signal locks the error calculation (SP - PV). The integral (I) component of the PID controller continuously ramps the manipulated output (MV) attempting to eliminate the perceived error, driving heating to 100%.

Can I use Med3_R instead of building timer logic?

Yes. If three transmitters are installed, Med3_R automatically selects the middle value, filtering out frozen high or frozen low transmitters without complex switching circuits.

What execution OB should host the freeze detection logic?

The detection logic should execute in the same cyclic interrupt OB as the channel driver and PID controller (typically OB35 with a 100 ms period).

Does SelA02In cause bumps when switching between sensors?

If there is a slight temperature offset between Sensor A and Sensor B, switching can cause a minor step. To eliminate bumps, pass the backup signal through a rate limiter (RateLim) or enable PID bumpless tracking.