Many safety requirements can be met using electrically redundant sensor arrangements. Higher safety demands might also require mechanical redundancy – for example using two sets of mechanical components, again preferably arranged such that their failure modes differ.
A common adage in safety related system design is that when two sensors measure the same parameter, then if one of the sensors gives an incorrect output it may not be obvious which one is wrong. Simply put, they do not agree. Accordingly, the host system should be engineered such that it continues to operate only if the two sensors agree within reasonable bounds. If they do not agree the system should revert to its fail-safe state (or possibly reduced performance state).
Of course, whenever safety is a concern, it is an absolute must that highly robust and reliable sensors are selected. Non-contact, inductive sensors are an extremely reliable form of measurement device as they are not subject to failure modes caused by wear, dirt, condensation etc. Nevertheless, no matter how reliable, every sensor has a finite mean-time between failure. It should also be the case that the host control system should be arranged so that, as far as practical, reasonableness tests can be employed. These tests may include for example:
- out of bounds measurements – if position measurements in a range of 1-1000units is expected and a measurement of 7000units is received it can be used as an error flag
- impossible steps in position or speed – if a system operates normally in arrange of say 0-60 rpm and a speed of 120rpm is shown then an error should be flagged
- cross-referenced motions – for example if the angular motion of two mating gears is sensed – one which rotates clockwise causing the second to rotate anti-clockwise, then if both are sensed to be rotating clockwise an error should be flagged. Similarly, if their speeds do not vary in accordance with their gear ratio an error can be flagged.
- out-of-bounds energy consumption – for example an unduly high supply current to a sensor.
Notably, when MTBF data is aggregated, duplex arrangements are less reliable than simplex systems because of the inherently greater electrical and mechanical complexity. The most demanding applications – notably in aerospace, heavy industrial, and oil and gas applications – might also require that the host system continues to operate in the case of sensor failure. In such instances, it may be the case that a triplex arrangement is required whereby the host system is configured so that a voting arrangement can instigated. In other words, at least two of the three sensors must agree within reasonable bounds for the equipment to operate (possibly at a reduced performance level). At an extreme, all three sensors should differ such that all three do not have common failure modes and, as far as practical, the system should include some elements of mechanical redundancy.