DE10242128A1 - Redundant sensor system monitoring arrangement in which a monitoring signal equal to the difference between the two sensor signals is compared with a variable threshold function that is derived from the two sensor signals - Google Patents

Abstract

Method for monitoring a redundant sensor arrangement in which two sensors (1, 2) that measurement the same value. A monitoring signal (DELTAy) is generated that is formed from the difference between the two sensor signals. The difference signal is compared with a threshold signal that is a function of a signal that is derived from the two sensor signals. An Independent claim is made for a device for monitoring a redundant sensor arrangement with a unit for monitoring the sensor signal difference compares with a threshold signal that is derived from the two sensor signals.

Description

The invention relates to a method for surveillance a redundant sensor arrangement with at least two sensors, which measure the same measure, according to the generic term of claim 1, and a corresponding device according to the preamble of claim 8.

In many monitoring and control systems the function of the sensors used is essential. In particular sensors, the failure of which presents a considerable security risk is therefore constantly monitored.

One way is to use the to monitor safety-critical sensors using so-called "analytical redundancy". Here, the sensor signal of the sensor to be checked with the result compared a model calculation in which the sensor signal on the Basis of sensor signals from other sensors is estimated.

Another way to check security-critical Sensors consists of at least one redundant sensor arrangement to provide two sensors that measure the same measured variable. A sensor error is common in this case detected when the measured values of the two sensors are too far apart deviate or e.g. unexpectedly high signal jumps occur. For sensor monitoring is therefore usually a difference signal (difference between the two sensor signals), as well as a difference derivative signal (difference of the temporal Derivatives of the two sensor signals) are calculated and checked whether the Differences are within specified limits. These limits are fixed maximum values that depend on the tolerance and the measuring range dependent on the sensors are (the larger the Sensor tolerance and the larger the Measuring range, the higher the limit). With two sensors whose signals differ only slightly or are identical, a relatively large amount of disgruntlement is therefore required one of the sensors until the difference signal reaches the predetermined high Limit Exceeded Has. A sensor error can therefore only be recognized relatively late.

It is therefore the object of the present invention a method and a device for monitoring a redundant To create a sensor arrangement with which a sensor error can be detected earlier can.

This object is achieved according to the invention by the features specified in claim 1 and 8. Further Embodiments of the invention are the subject of dependent claims.

The main idea of the invention consists in a redundant sensor arrangement with a first and a second sensor a signal, e.g. a difference signal or a difference change signal, that is formed from the sensor signals of the two sensors with to compare a variable limit that is also a function of the two sensor signals. The variable limit is usually smaller than a maximum value, as determined in the prior art becomes. Thus, even with a slight sensor misalignment Sensor errors are recognized.

The limit value monitored signal is preferred a difference signal, i.e. on from the difference between the two sensor signals formed signal, or a difference change signal, i.e. a signal representing the change in time of the difference signal represents. You can choose also other signals formed from the sensor signals for limit value monitoring be used.

In the case of a difference signal the difference signal with a corresponding variable limit and in the case of a difference change signal becomes the difference change signal compared with a corresponding other variable limit. exceeds monitored the limit Signal the predetermined limit, becomes a sensor error accepted in one of the sensors.

The variable limit is preferably one Function of an average signal, which consists of the two sensor signals is formed. The mean signal is e.g. the arithmetic mean of the two sensor signals.

The variable limit is regularly updated on the Recalculated based on sensor signals.

According to a preferred embodiment of the According to the invention, the sensor monitoring is preferably also carried out redundantly, wherein preferably both differential monitoring (limit value monitoring of the differential signal) as well as dynamic monitoring (limit value monitoring of the Difference-varying signal) is carried out. The limit is at least one of the two signal monitors variable and a function of the two sensor signals, preferably one Function of an average signal.

A surveillance system to monitor a redundant sensor arrangement with a first sensor and a second Sensor, which detect the same measured variable, includes one Unit for generating a limit monitored signal, which from the sensor signals of the two sensors is formed, and a Monitoring unit this signal, which compares the signal to a limit value, the is a function of the two sensor signals. The variable limit is preferably carried out regularly in a corresponding unit recalculated.

The unit for generating the limit value monitored signal is preferably a unit for difference formation, which calculates a difference signal from the two sensor signals. In this case, the unit for signal monitoring is a unit for differential monitoring, which compares the differential signal with the predetermined variable limit value and checks whether there is a sensor error.

Optionally, the unit for generating the Monitored limit value Signal also a unit for generating a difference change signal be that from the recorded at different times Difference signal calculates a difference change signal. The monitoring unit in this case, a unit for monitoring the difference change signal compares the signal with a corresponding variable limit, which is a function of the two sensor signals. If exceeded the limit value is in turn recognized on a sensor error. A Arrangement comprising the unit for generating the difference change signal and the surveillance unit of the difference change signal is included in the following as a unit for dynamic monitoring designated.

According to a preferred embodiment of the Invention includes the system for monitoring the redundant sensor arrangement at least two monitoring units, the one signal derived from the sensor signals, preferably the difference signal, monitor redundantly. The differential signal derived from the sensor signals becomes, for example by means of a unit for differential monitoring, and by means of a Monitoring unit for dynamic monitoring. The differential monitoring unit detects a sensor error, if the difference signal exceeds an associated limit value, and the dynamic monitoring unit a sensor error if the temporal change in the difference signal exceeds the predetermined second variable limit.

Results in monitoring in one of the monitoring units a sensor error, a sensor error is recognized. The outputs of the monitoring units are preferably logically linked for this purpose.

Any other can be chosen any signal monitored be derived from the sensor signals of the two sensors. In this case there is a corresponding variable limit to calculate, which is a function of the two sensor signals.

The invention is illustrated below the attached Exemplary drawings closer explained. Show it:

1 a block diagram of a sensor with a simple monitoring unit;

2 a block diagram of a sensor with a redundant monitoring unit;

3 a block diagram showing the difference monitoring;

4 a block diagram showing the dynamic monitoring;

5 a graphic representation of sensor deviations that can be detected with a monitoring unit according to the prior art;

6 a graphical representation of the sensor deviations that can be detected with a monitoring unit according to the invention; and

7 a representation of the limit value of a difference signal as a function of the measured variable x.

1 shows a redundant sensor arrangement with a first sensor 1 and a second sensor 2 , as well as one on the sensors 1 . 2 connected monitoring unit 10 , The essential elements of the monitoring unit are one unit 5 for averaging, one unit 6 for difference formation as well as a unit 7 for difference monitoring. The reference numbers 3 and 4 denote filters for filtering interference signals from the sensor signals. The monitoring unit 10 works according to the following basic principle:
The unit 6 to form the difference, first generates a difference signal Δy from the sensor signals y1, y2. The difference signal Δy is from the unit 7 for differential monitoring, the limit value is monitored, ie compared with a predetermined limit value, in order to detect a malfunction of the sensors 1 . 2 to be able to determine.

The essential aspect of the invention is now that the maximum limit for the deviation of the sensor signals y1, y2 not from each other with a constant limit, but is compared to a variable limit that is a function the sensor signals is.

In this embodiment, the limit value is calculated on the basis of an average signal yM, which is generated by the unit 5 generated for averaging from the two sensor signals y1, y2 and the unit 7 is supplied for difference monitoring. The limit value calculated in this way is therefore usually less than a maximum value. The sensor monitoring 10 thus speaks earlier.

The one from unity 7 Sensor status detected for differential monitoring is output as a signal status (status) to a subsequent evaluation unit.

The main principles of monitoring procedure used here are shown again mathematically in the following.

The sensor characteristics of the sensors 1 . 2 are usually flawed and therefore deviate from the actual value of the quantity x to be measured. The following applies: Sensor 1: y1 = x + n1 + x * s1 Sensor 2: y2 = x + n2 + x * s2

As can be seen, these have Sensor signals y1, y2 a zero point error (offset) n1, n2 as well a sensitivity error s1, s2. The deviations are there within given allowable Limits. Only when exceeded of these limits, a sensor error should be recognized. The following applies.

Zero point error: –N ≤ n1 ≤ + N, –N ≤ n2 ≤ + N Sensitivity error: –S ≤ s1 ≤ + S, –S 5 s2 ≤ + S The following is assumed for the measuring range: –xmax ≤ x ≤ + xmax Unit 6 to calculate the difference, calculate a difference signal Δy according to the following relationship: Δy = y2 - y1 = n2 - n1 + x * s2 - x * s1

With maximum sensor deviations n1, n2 or s1, s2, the magnitude of the difference signal Δy has the following permissible value: | .DELTA.Y | ≤ 2 * N + 2 * S * | x | (1)

The value to the right of this inequality cannot be used directly as a limit for monitoring the difference signal Δy be because the actual physical value of the measured variable x not is known. Therefore, the Value x can be estimated in a suitable manner.

In the prior art, this is done according to the worst case estimate with: | X | = xmax

According to the illustration from 1 the measured variable x, on the other hand, is estimated on the basis of the mean value yM of the sensor signals y1, y2. The following applies: yM = 0.5 * (y1 + y2) = x + 0.5 * (n1 + n2 + x * s1 + x * s2) and changed to x: x = yM - 0.5 * (n1 + n2 + x * s1 + x * s2) With maximum sensor deviations N, S follows: | X | ≤ | YM | + N + | x | * S

Solving this implicit inequality after x leads to: | X | ≤ (| YM | + N) / (1 - s) (2)

If you put this estimate ( 2 ) for the measured variable x in the limit analysis mentioned above ( 1 ) of the difference signal _{Δy, the} following statement is obtained for the limit value Δy limit: | Ay | ≤ 2 * N + 2 * S * ((| yM | + N) / (1 - S)) = Δy cross (3)

As can be seen, this limit value Δy _limit depends on the mean value yM of the sensor signals y1, y2 and is therefore variable.

If, on the other hand, a maximum constant value is used for the measured variable x, the following limit analysis results for the difference signal Δy: | Ay | ≤ 2 * N + 2 * S * xmax = Δyg Conference = constant

The unit 7 for differential monitoring compares the difference signal Δy according to the invention with the variable limit. In cheap Difference situations can cause a sensor error very quickly, at only minor changes of a sensor signal can be recognized.

The 5 and 6 show the error detectability of deviations of the second sensor in the case of a predetermined error (n1, s1) of the first sensor 1 , Pairs (s2, n2) are shown which are recognized as faulty by a method or a device according to the invention. It shows 5 detectable deviations of the second sensor with fixed limit values with an estimate x = xmax (prior art) and 6 a representation of the detectable deviations for the second sensor using a variable limit value, which was calculated on the basis of the mean value signal, in each case for different difference situations.

One for fault detectability unfavorable Difference situation exists when the zero point and sensitivity error n1, s1 of the first sensor 1 assumes values at which the error detection method relatively late, i.e. at large Deviation for n2, s2 responds.

An unfavorable difference situation exists, for example, if the sensor 1 located at the top of the specification, with n1 = N, s2 = S and the sensor 2 exceeds the upper limit of the specification (graph a).

A difference situation that is favorable for error detectability, on the other hand, exists when the sensor 1 located at the bottom of the specification, with n1 = –N, s1 = –S and the sensor 2 exceeds the top of the specification (Graph c).

Like a comparison of the 5 and 6 shows, with the same sensitivity error s2 (eg 5%) a zero point error n2 can be reached much earlier, ie with smaller values for n2.

Graph b shows a medium-priced difference situation. Here too ( 6 ) a much earlier error detection compared to the prior art ( 5 ) to recognize.

The procedure for differential monitoring with a variable limit value is again based on 3 exemplified. When choosing parameters A, B with A = 2 * N + 2 * N * S / (1 - S) and B = 2 * S / (1 - S) the above formula (2) can be written as follows: | Ay | ≤ A + B * | yM | = Δy cross (4)

3 shows the method for monitoring a redundant sensor arrangement in the form of a block diagram. In it a difference signal Δy after the amount formation in block 21 according to the above formula (4) is compared with the threshold value Dy _cross. The comparison is made in block 25 ,

The limit Δy _limit is set in block 22 calculated on the basis of an average signal yM. The mean signal yM is in block 20 first in amount and then in block 23 multiplied by the parameter B and in block 24 parameter A is added. The result of this procedure is a limit value Δy _limit for the difference signal Δy, which in block 25 is compared with the (absolute value) difference signal Δy. The result of this comparison is a status signal StatusDiff for differential monitoring, which shows the state of the sensor arrangement 1 . 2 displays. If there is a fault in one of the sensors 1 . 2 the status signal StatusDiff assumes the value logic 1, for example.

7 shows the limit value Δy _limit during a differential _monitoring over the value range of the measured variable x for various zero point and sensitivity errors n2 or s2. As can be seen, the limit values Δy _limit in the lower and middle measuring range (up to x = 60) are smaller than the maximum, constant limit value (characteristic curve d, Δy _limit = 15).

The following applies to characteristic curve a (very faulty sensors): n2 = 8 * N, s2 = 8 * S, for characteristic curve b (faulty sensors): n2 = 4 * N, s2 = 4 * S, characteristic curve c for ideal ones sensors 1 . 2 ,

In addition to the differential monitoring, the dynamics of the sensor signals y1, y2 can also be monitored, for example. Such redundant sensor monitoring is in 2 shown.

2 shows a sensor arrangement with a redundant monitoring unit, comprising a first sensor 1 and a second sensor 2 whose signals y1, y2 in one unit 5 for averaging and in one unit 6 can be processed to form a difference to an average signal yM or to a difference signal Δy. The latter signals are both the unit 7 for differential monitoring as well as a parallel unit 8th fed for dynamic monitoring.

The unit 8th for dynamic monitoring, calculates a difference change signal ΔΔy, which represents the change over time of the difference signal Δy, where: ΔΔy = Δy (t2) - Δy (t1) = (y2 (t2) - y1 (t2)) - (y2 (t1) - y1 (t1)) (5)

When calculating the difference change signal, the time dependencies of the zero point and sensitivity errors n1, n2 and s1, s2 must also be taken into account. The zero point and sensitivity errors n1, n2 or s1, s2 can be divided into a time-variant and a time-variant component: n (t) = n 0 + n '' (t) with - N 0 ≤ n 0 ≤ + N 0 , –N '' ≤ n '' (t) ≤ + N '' S (t) = S 0 + S '' (t) m1t –S 0 ≤ S 0 ≤ + S 0 , –S '' ≤ S '' (t) ≤ + S ''

The following therefore applies to the sensor characteristics: y1 (t) = x (t) + n1 0 + n1 '' (t) + x * (s1 0 + s1 '' (t)) y2 (t) = x (t) + n2 0 + n2 '' (t) + x * (s2 0 + s2 '' (t)) Inserted in the above formula (5), this leads to: ΔΔy = n2 '' (t2) - n2 '' (t1) - n1 '' (t2) + n1 '' (t) + (x (t2) - x (t1)) * (s2 0 - s1 0 ) + x (t2) * (s2 '' (t2) - s1 '' (t2)) - x (t1) (s2 '' (t1) - s1 '' (t1))

The following therefore applies to the limit value ΔΔy _{limit of} the difference change _signal : IΔΔy | ≤ 4 * N '' + 2 * S 0 * | x (t2) - x (t) | + 2 * S '' * (| x (t2) | + | x (t1) |) =: a + Δb + Δc = ΔΔy cross

The parameters a, b, c are abbreviations for the summands of the above relationship. The terms Δb and Δc must again be estimated because they contain the unknown physical values x (t1) and x (t2). There are various options I-IV: Δb-I: Δb ≤ 4 * S 0 * xmax (worst case estimate) Δb-II: Δb ≤ 2 * S 0 * Α * | t2-t1 | where α is an estimate of the maximum gradient of x, with | dx (t) / dt | ≤ α Δb-III: Δb ≤ 2 * S 0 * (2 * N '' + | yM (t2) - yM (tl) |) / (1 - 2 * S) Δb-IV: Δb ≤ 2 * S 0 * (2 * N '' + | yM (t2) | + | yM (t1) |) / (1 - 2 * S)

The estimate Δb-IV is derived from Δb-III, with a maximum estimate of the term | yM (t2) - yM (t1) |.

The limit value estimate of Δb-I provides a constant, worst case limit. The estimation Δb-II is useful if α is known and the time difference | t2-t1 | is small. If α is unknown, alternatively Δb-III can be used. The estimate Δb-IV should also be seen as an alternative to Δb-II if a is unknown and only absolute values for yM are known.

For example, the following estimates can be made for the parameter Δc: Δc-I: Δc ≤ 4 * S '' * xmax (worst case estimate) Δc-II: Δc ≤ 2 * S '' * (2 * N + | yM (t2) | + | yM (t1) | / (1 - S)

The combination Δb-I and Δc-I leads to the following constant limit ΔΔy _limit ΔΔy cross = 4 * N '' + 4 * S * xmax

A combination of Δb-II and Δc-II, on the other hand, provides a variable limit ΔΔy _limit ΔΔy cross = 4 * N '' + 2 * S 0 + α * | t2 - t1 | + 2 * S '' * (2 * N + | yM (t2) | + | yM (t1) |) / (1 - s)

This can also be done with the parameters C and D ΔΔy cross = C + D * (| yM (t 2) | + | yM (t1) |) be written with C = 4 * N '' + 2 * S 0 * α * | t2 - t1 | + 4 * S '' * N / (1 - S) D = 2 * S '' / (1 - S)

The process of dynamic monitoring is again in 4 represented by a block diagram. The actual comparison of the difference change signal ΔΔy (or the amount) with the limit value ΔΔy _limit takes place in a block 34 that, as a result, the functional state of the sensors 1 and 2 indicated by a StatusDyn signal.

The difference change signal ΔΔy is made from the difference signal Δy by a Δt delay (Δt = t2 - t1) in block 27 and by forming a difference (Block 32 ) generated. In block 33 finally the absolute value of the difference change signal ΔΔy is formed.

The limit ΔΔy _limit is in the unit 35 to determine the limit value, taking the mean value signal yM first (block 26 ) and summed with an average signal yM (t2) delayed by Δt (blocks 28 . 29 ). The sum of the mean signals yM is then in block 30 multiplied by the parameter D and in block 31 the parameter C is added. The result is the limit ΔΔy _limit .

The Δt delays (block 28 and 27 ) Buffer the input signals and pass them around Δt = | t2 - t1 | delayed from.

The comparator 34 returns a status signal, eg statusdyn = 1 for | ΔΔy | > ΔΔy _limit and a value of logic zero for | ΔΔy | <ΔΔy limit

1

first sensor

2

second sensor

3

filter

4

filter

5

unit for averaging

6

unit for limit value formation

7

unit for difference monitoring

8th

unit for dynamic monitoring

9

Or link

20

block for the formation of amounts

21

block for the formation of amounts

22

unit for limit value formation

23

multiplication

24

addition

25

comparison block

26

block for the formation of amounts

27

block for the Δt delay

28

block for the Δt delay

29

addition

30

multiplication

31

addition

32

subtraction

33

block for the formation of amounts

34

comparison block

y1, y2

sensor signals

yM

Average signal

Dy

difference signal

statusdif

status signal

statusdyn

status signal

Δy _limit

limit for the differential monitoring

ΔΔy _limit

limit for the dynamic monitoring

Dy

difference signal

ΔΔy

Differential signal change

Claims (13)

Method for monitoring a redundant sensor arrangement with a first sensor ( 1 ) and a second sensor ( 2 ), which detect the same measurement variable (x), in which a signal to be monitored (Δy), which is generated from the sensor signals (y1, y2), of the two sensors ( 1 . 2 ) is formed, is compared with a predetermined limit value (Δy _limit ) to determine the function of the sensors ( 1 . 2 ) to be checked, characterized in that the limit value (Δy _limit ) is a function of a signal (yM) which is also derived from the two sensor signals (y1, y2) passes. A method according to claim 1, characterized in that the limit was monitored Signal a difference signal (Δy) of the two sensor signals (y1, y2). A method according to claim 1 or 2, characterized in that that the limit (Δy limit) a function of an average signal (yM) of the two sensor signals (y1, y2). A method according to claim 1, characterized in that the limit was monitored Signal a difference change signal (ΔΔy) is which the change over time a difference signal (Δy) represents. Method according to claim 1, characterized in that a second limit value monitored signal (ΔΔy) is formed from the sensor signals (y1, y2), which is compared with a second limit value (ΔΔy _limit ) in order to determine the function of the sensors ( 1 . 2 ) to monitor redundantly. Method according to claim 5, characterized in that the second limit value (ΔΔy _limit ) is a function of a signal (yM) which is derived from the two sensor signals (y1, y2). A method according to claim 5 or 6, characterized in that that the first limit was monitored Signal a difference signal (Δy), monitored the second limit Signal a difference change signal (ΔΔy), and the first and / or second limit value a function of an average signal (yM) of the two sensor signals (y1, y2). Device for monitoring a redundant sensor arrangement with a first sensor ( 1 ) and a second sensor ( 2 ), which capture the same measurement variable (x) that a unit ( 6 ) to generate a signal to be monitored (Δy) from the sensor signals (y1, y2) of the two sensors ( 1 . 2 ), and a unit for monitoring the signal (Δy), which compares the signal (Δy) with a predetermined limit value (Δy _limit ) in order to determine the function of the sensors ( 1 . 2 ), characterized in that the unit ( 7 ) for monitoring the signal (Δy) calculates a limit value (Δy _limit ) which is a function of the two sensor signals (y1, y2). Device according to claim 8, characterized in that the unit ( 6 ) to generate the limit value monitored signal, a difference signal (Δy) is calculated from the sensor signals (y1, y2) from the two sensors. Device according to claim 8 or 9, characterized in that the unit ( 7 ) for monitoring the monitored signal (Δy) calculates a limit value (Δy _limit ) which is a function of an average value (yM) of the two sensor signals (y1, y2). Device according to claim 8, characterized in that the unit ( 7 ) one unit to check the signal to be monitored ( 7 ) for differential monitoring and is also a unit ( 8th ) is provided for dynamic monitoring, which calculates a difference-change signal (ΔΔy) and compares it with a second limit value (ΔΔy limit) in order to determine the function of the sensors ( 1 . 2 ) to check. Device according to claim 11, characterized in that the unit ( 8th ) for dynamic monitoring a second limit value (ΔΔy _limit ) is calculated, which is a function of the two sensor signals (y1, y2). Device according to claim 12, characterized in that the second limit (ΔΔy limit) is a Function of an average signal (yM) of the two sensor signals (y1, y2) is.