Method for monitoring at least two redundant sensors

Abstract

The invention relates to a method for monitoring at least two redundant sensors, which are in particular arranged in a chemical plant or an aircraft, comprising providing a first sensor signal of a first sensor, the first sensor signal comprising at least one measured value, providing at least one further sensor signal from a further sensor, the further sensor signal comprising at least one further measured value, generating a first analysis signal from the first sensor signal, generating at least one further analysis signal from the further sensor signal, determining at least one relationship between the first sensor signal and the further sensor signal at least in dependence on the first analysis signal and the further analysis signal over a time horizon, comparing the relationship with at least one admissible range, and, depending on the result of the comparison, determining whether at least one sensor of the two redundant sensors is faulty.

Claims

1. Computer-implemented method for monitoring at least two redundant sensors arranged in a chemical plant, comprising: a) providing at least two redundant sensors, b) providing a first sensor signal of a first sensor of the at least two redundant sensors, the first sensor signal comprising at least one measured value, c) providing at least one further sensor signal from a further sensor of the at least two redundant sensors, the further sensor signal comprising at least one further measured value, d) generating at least one first analysis signal from the first sensor signal, e), generating at least one further analysis signal from the further sensor signal, f) selecting a time horizon for the sensor signals from b), c) by comparison of the analysis signals from d) and e) with predefined limits for the variance, stationarity and/or dynamics of the sensor signal, g) determining at least one correlation between the first analysis signal of the first sensor and the analysis signal of the further sensor, h) comparing the correlation with at least one admissible correlation range or the difference with an admissible difference range, and i) depending on the result of the comparison according to h), determining whether at least one sensor of the two redundant sensors is faulty, j) issuing the determination according to i); wherein in d), a second derivative of the first sensor signal is generated, and in e), a second derivative of the further sensor signal is generated, and in f), a horizon in which there are a minimum number of datapoints is ascertained, comprising a second time derivative, the absolute value of which lies above a specified dynamics limit value of the second derivative.

2. Method according to claim 1, wherein in d), a standard deviation of the first sensor signal is additionally generated, and in e), a standard deviation of the further sensor signal is additionally generated, and in g), a difference signal is determined from the standard deviation of the first sensor signal and the standard deviation of the further sensor signal, then a first cross-correlation between the determined difference signal and the standard deviation of the first sensor signal is determined, and a further cross-correlation between the determined difference signal and the standard deviation of the further sensor signal is determined, the ratio of the first cross-correlation and the further cross-correlation is determined, and in h) the determined ratio is compared with an admissible ratio range.

3. Method according to claim 2, wherein, if the calculated ratio lies outside the admissible ratio range, the faulty sensor is the sensor with the smaller absolute value of the cross-correlation and a corresponding notification is issued.

4. Method according to claim 1, wherein a Spatial distance between the first sensor and the further sensor is determined, and -depending on a volumetric flow measurement and on the spatial distance between the sensors, at least one of the sensor signals provided is processed on a time basis.

5. Method according to claim 4, wherein depending on the spatial distance between the first sensor and the further sensor, one of the sensor signals provided is processed on a time basis by a delay element of at least the first order, and/or depending on the volumetric flow measurement and on the spatial distance between the sensor and the further sensor, one of the sensor signals provided is processed on a time basis by a dead time element.

6. Method according to claim 1, wherein, before determination of the first analysis signal and/or of the further analysis signal, at least one of the recorded sensor signals is filtered in a filtering step in such a way that at least measuring noise is filtered out from the sensor signal.

7. A monitoring device for performing the method of monitoring at least two redundant sensors arranged in a chemical plant according to claim 1, comprising: at least one receiving device designed for receiving the first sensor signal of the first sensor of the two redundant sensors and for receiving at least one further sensor signal from the further sensor of the two redundant sensors, the first sensor signal comprising the at least one measured value and the further sensor signal comprising at least one measured value, at least one processing device designed for generating said a first analysis signal from the first sensor signal and for generating said at least one further analysis signal from the further sensor signal, the processing device being designed for determining at least one correlation condition between the first sensor signal and the further sensor signal at least in dependence on the first analysis signal and the further analysis signal, wherein the at least one correlation condition comprises selecting said time horizon for the sensor signals by comparison of the analysis signals with said predefined limits for the variance, stationarity, and/or dynamics of the sensor signal, and determining at least one correlation between the first analysis signal of the first sensor and the analysis signal of the further sensor, at least one comparing device designed for comparing the correlation condition with the at least one admissible correlation range, and at least one evaluation device designed for determining whether, depending on the result of the comparison, at least one sensor is faulty.

8. Chemical plant, comprising: at least one monitoring device according to claim 7.

Description

(1) There are thus a multitude of possibilities for refining and further developing the monitoring device according to the invention, the method according to the invention and the chemical plant according to the invention. In this respect, reference should be made on the one hand to the patent claims arranged subordinate to the independent claims, on the other hand to the description of exemplary embodiments in conjunction with the drawing. In the drawing:

(2) FIG. 1 shows a schematic partial view of an exemplary embodiment of a chemical plant according to the present invention;

(3) FIG. 2 shows a schematic partial view of a further exemplary embodiment of a chemical plant according to the present invention;

(4) FIG. 2a shows a schematic partial view of an exemplary embodiment of an aircraft according to the present invention;

(5) FIG. 3 shows a schematic view of an exemplary embodiment of a monitoring device according to the present invention;

(6) FIG. 4 shows a diagram of an exemplary embodiment of a method according to the present invention;

(7) FIG. 5 shows a diagram given by way of example with variations of sensor signals;

(8) FIG. 6 shows a further diagram given by way of example with variations of analysis signals; and

(9) FIG. 7 shows a further diagram given by way of example with variations of analysis signals.

(10) Hereinafter, the same designations are used for the same elements.

(11) FIG. 1 shows a schematic partial view of an exemplary embodiment of a chemical plant 100 according to the present invention. In particular, in the present exemplary embodiment part of a fluid line 106 of a chemical plant 100 is depicted. Through the fluid line 106 there flows a fluid, which can be monitored by redundant sensors 102.1, 102.2.

(12) In the present case, two redundant sensors 102.1, 102.2 are arranged in the fluid line 106. In the present exemplary embodiment, the sensors 102.1, 102.2 are at a distance from one another. Allowance may be made for the structural relationship between the sensors 102.1, 102.2 in the detection of a faulty sensor 102.1, 102.2, as will be explained below. The sensors 102.1, 102.2 may however also be arranged directly next to one another. Furthermore, the redundant sensors 102.1, 102.2 may be designed for measuring at least one similar process variable. For example, the process variable may be the temperature of the fluid, the pressure within the fluid line 106, the flow rate, the pH of the fluid, etc.

(13) The first sensor signal may be made available by the first sensor 102.1 to a monitoring device 104 via a communication link 108. A further sensor signal may be made available by the further sensor 102.2 via a communication link 108 of the monitoring device 104. Each sensor signal may be formed by a plurality of measured values. The monitoring device 104 is designed in particular to detect a faulty sensor 102.1, 102.2. When a faulty sensor 102.1, 102.2 is detected, corresponding information can be issued via an output 110 from the monitoring device 104.

(14) The monitoring device 104 may be at least part of a computing device comprising processing means, storage means, etc.

(15) FIG. 2 shows a schematic partial view of a further exemplary embodiment of a chemical plant 200 according to the present invention. In comparison with the exemplary embodiment above, in this exemplary embodiment a chemical apparatus 212 is provided, arranged between the redundant sensors 202.1 and 202.2. The chemical apparatus 212 may be designed for processing a substance or a fluid. Allowance may also be made for the structural relationship between the redundant sensors 202.1 and 202.2 in a detection of a faulty sensor 202.1, 202.2. The respective sensor signals of the first and further sensors 202.1, 202.2 may be delivered to a monitoring device 204.

(16) FIG. 2a shows a schematic partial view of an exemplary embodiment of an aircraft 250 according to the present invention. The speed of the aircraft is monitored in the present case by the sensors 252.1, 252.2. The first sensor signal may be made available by the first sensor 252.1 to a monitoring device 254 via a communication link 258. A further sensor signal may be made available by the further sensor 252.2 to the monitoring device 254 via a communication link 258. Each sensor signal may be formed by a plurality of measured values. The monitoring device 254 is designed in particular to detect a faulty sensor 252.1, 252.2. If a faulty sensor 252.1, 252.2 is detected, corresponding information can be issued via an output 260 from the monitoring device 254.

(17) An exemplary embodiment of a monitoring device 104, 204, 254 is explained in more detail below.

(18) FIG. 3 shows a schematic view of an exemplary embodiment of a monitoring device 304 according to the invention. As can be seen, the monitoring device 304 has in the present case a first receiving device 314.1 designed for receiving a first sensor signal and a further receiving device 314.2 designed for receiving a further sensor signal. It goes without saying that a common receiving device may also be provided.

(19) In the present case, the two sensor signals are provided for a processing device 316. The processing device 316 is designed to generate a first analysis signal from the first sensor signal and to generate at least one further analysis signal from the further sensor signal. Furthermore, the processing device 316 is designed for determining at least one correlation between the first analysis signal of the first sensor and the analysis signal of the further sensor or a difference between the first sensor signal of the first sensor and the sensor signal of the further sensor.

(20) The correlation or the difference may be made available to a comparing device 318, which is designed for the comparison with at least one admissible (specified) correlation or difference range or limit. The result of the comparison may be made available to an evaluation device 320. The evaluation device 320 is designed for determining whether at least one sensor is faulty. This determination takes place in a way dependent on the result of the comparison. If the evaluation device 320 finds that at least one of the monitoring sensors is operating faultily, it can pass this on to an output device 322, in order for example to give a warning and/or an alarm by way of an output 310.

(21) The monitoring device described above of the chemical plant or of the aircraft is described in more detail below with the aid of FIG. 4. FIG. 4 shows a diagram of an exemplary embodiment of a method according to the present invention. It should be noted for the following statements that the sensors are denoted by the index s and the measured value of a sensor is denoted by m.

(22) In a first step 401, a sensor signal is respectively made available by the at least two redundant sensors. In particular, a monitoring device receives at least one first sensor signal of a first sensor and a further sensor signal of a further sensor. The further sensor forms a reference for the first sensor to be investigated.

(23) Conversely, the first sensor is the reference for the further sensor. Consequently, it is always possible for at least two sensors to be investigated together as a pair of sensors. A detection of a fault may then concern this pair of sensors. The fault should be interpreted in particular as a relative fault. A detected fault may consequently be interpreted either as a positive fault for one sensor or as a negative fault for the other sensor.

(24) In an optional next step 402, allowance may be made for structural relationships between the redundant sensors, in particular plant-related delays between the first sensor signal and the further sensor signal. A plant-related delay may for example result from the different measuring positioning of the first sensor, e.g. at a first end of a fluid line, and a further sensor, e.g. at the other end of the fluid line (cf. FIG. 1). A further example is that a first sensor is arranged upstream of a chemical apparatus and a further sensor is arranged downstream of the chemical apparatus (cf. FIG. 2).

(25) Preferably, in step 402, the structural relationship for the then resultant dynamic behaviour may be (roughly) described by a first-order delay element (PT1) and/or by a dead time element (PTt). In the examples mentioned above, the upstream sensor may be delayed by the first-order delay element (PT1) or a delay element of a higher order (PTn) or by the dead time element (PTt), in order in particular to achieve the effect that the measurements of the two sensors are characterized by the same temporally adapted process dynamics. This allows a more reliable analysis of sensor behaviour.

(26) With the aid of a volumetric flow measurement V between the two measuring positions, the time constant T.sub.delay can be calculated as a delay time between the two measuring positions of the first and further sensors.

(27) $\begin{array}{cc}{T}_{\mathrm{delay}}=\frac{V}{\stackrel{.}{V}},& \left(1\right)\end{array}$

(28) where V is the volume, assumed to be known, of a fluid line or the filling volume of the chemical apparatus or the like.

(29) If the dynamic behaviour of the apparatus located between the measuring positions concerns a first-order delay element (PT1), the upstream measuring signal can be delayed in time in particular by way of a PT1 filter:

(30) $\begin{array}{cc}m\left(t_k\right)=\frac{T_{\mathrm{delay}}}{T_{\mathrm{samp}}+T_{\mathrm{delay}}}m\left(t_{k-1}\right)+\frac{T_{\mathrm{delay}}}{T_{\mathrm{samp}}+T_{\mathrm{delay}}}{m}_{\mathrm{orig}}\left(t_k\right),& \left(2\right)\end{array}$

(31) where m.sub.orig denotes the original measured value and T.sub.samp denotes the sampling time between the measured values or datapoints that are measured and t.sub.k denotes the current point in time.

(32) Generally, the filtering of the measuring signal can be formulated as follows:
m(t.sub.k)=filter(m(t.sub.k-1),m.sub.orig,T.sub.delay,T.sub.samp  (3)

(33) If the dynamic behaviour of the apparatus located between the measuring positions concerns a dead time element (PTt), the downstream measuring signal can preferably be delayed by way of a time displacement
m(t.sub.k)=m.sub.orig(t.sub.k−T.sub.delay)  (4)
where m.sub.orig is the original measured value.

(34) It goes without saying that this step 402 may be omitted if there is no need to make allowance for structural relationships between the sensors, such as plant-related delays, because of a substantially identical measuring position.

(35) In an optional step 403, sensor signals may be filtered to improve signal quality. For example, it may be envisaged to preprocess the first and/or the further sensor signal by way of a filter, such as a first-order filter PT1, in order to filter out measurement noise and/or short-term dynamic trends:

(36) $\begin{array}{cc}{m}_f\left(t_k\right)=\frac{T_{\mathrm{fil}}}{T_{\mathrm{samp}}+T_{\mathrm{fil}}}{m}_f\left(t_{k-1}\right)+\frac{T_{\mathrm{fil}}}{T_{\mathrm{samp}}+T_{\mathrm{fil}}}m\left(t_k\right),& \left(5\right)\end{array}$

(37) where m(t.sub.k) is the measurement of the respective sensor at the point in time t.sub.k, m.sub.f(t.sub.k) is the filtered measurement, T.sub.fil is the filtering time, and T.sub.samp is the sampling time of the measurement (e.g. in the process control system or in the separate analysis computer).

(38) Generally, the filtering of the measuring signal can be formulated as follows:
m.sub.f(t.sub.k)=filter(m.sub.f(t.sub.k-1),m(t.sub.k),T.sub.fil,T.sub.samp).  (6)

(39) Following the optional steps 402 and 403, in step 404 a first analysis signal, preferably a standard deviation, may be generated, in particular calculated, from the first sensor signal and a further analysis signal, preferably a standard deviation, may be generated, in particular calculated, from the further sensor signal. As already described, the sensor signals may have been preprocessed in steps 402 and 403. For example, in step 404, the standard deviation x(t.sub.k) or std(t.sub.k) of the filtered sensor signal may then be calculated over a moving horizon:

(40) $\begin{array}{cc}x\left(t_k\right)=\mathrm{std}\left(t_k\right)=\sqrt{\frac{1}{n-1}\underset{i=1}{\overset{n}{.Math.}}({m_f\left(t_{k-i+1}-{\stackrel{\_}{m}}_f\left(t_k\right)\right)}^2},& \left(7\right)\end{array}$

(41) where m.sub.f(t.sub.K) is an average value, which can be calculated as follows:

(42) $\begin{array}{cc}{\stackrel{\_}{m}}_f\left(t_K\right)=\frac{1}{n}\underset{i=1}{\overset{n}{.Math.}}{m}_f\left(t_{k-i+1}\right).& \left(8\right)\end{array}$

(43) The moving horizon makes allowance in particular for the datapoints or measured values of the last n datapoints as from the present point in time. As the name already implies, the moving horizon moves as time passes, in particular in real time. If a new measured value is available, the last datapoint is dropped from the horizon; the remaining datapoints are displaced back by one time increment and the current datapoint with the new measured value is added. Generally, the calculation of the analysis signal ((7) and (8)) can be formulated as follows:
x(t.sub.k)=std(t.sub.k)=std(filter(m.sub.f(t.sub.k), . . . ,m.sub.f(t.sub.k-n+1)).  (9)

(44) In step 404, it is possible in particular to generate analysis signals that are particularly suitable as a starting point for the detection of an offset fault and/or a freezing fault. In particular, it has been realized that an analysis signal with fewer data values is required for a reliable detection of an offset fault and/or a freezing fault than in the case of the detection of a fouling fault. For the subsequently described offset and freezing calculation, the analysis signal x(t.sub.k) can be evaluated over a relatively short horizon n. The monitoring of the sensors can therefore take place at the time of the occurrence of possible offset and freezing faults, while the monitoring of fouling faults may require a greater horizon, and fouling faults therefore can only be detected with a delay. For the offset calculation, it may in particular be sufficient if the process is stabilized for a short time. Also the freezing calculation on the basis of analysis signals with a relatively short horizon functions sufficiently robustly. For a robust fouling calculation, the long-term dynamic trends are more important, so that here a separate analysis signal x(t.sub.k) may be determined over a longer horizon n in a step 422, as will be described below.

(45) In order to detect an offset fault, allowance for at least one plant-related process deviation may be made in an optional step 406. In particular, a correction valueΔ.sub.correction that makes allowance for the at least one plant-related process deviation may be determined. The correction value Δm.sub.correction may be required in particular whenever, for plant-related reasons, the process values of the measurement m.sub.2 at the further sensor differ from the process values of the measurement m.sub.1 at the upstream first sensor. The correction value may be known and in particular specified.

(46) In a next optional step 408, it may be checked whether the analysis data (the analysis signals) are sufficiently steady for an offset check. Every chemical plant (continuously) undergoes dynamic changes, which may be caused e.g. by disturbances or changes in setpoint values. In other words, a chemical plant is not continuously operated in a stationary state. Even if the sensors are arranged adjacently, the sensors to be investigated are not located exactly at the same place in the chemical plant. This leads to a time delay, for plant-related reasons, between the physical variables that are recorded by the two sensors. These short-term dynamic changes, for example because of disturbances or changes in setpoint values, cannot be predicted in advance, and therefore also cannot be filtered out in a way corresponding to step 402 or in a similar way. Nevertheless, allowance should be made for them in the offset detection in order to prevent false detections. In other words, the aim is not to interpret the occurrence of dynamic changes that lead to physical values deviating from one another for a short time at the positions of the redundant sensors as an offset between the two sensors. For a particularly reliable offset fault detection, it is therefore preferred to check in step 408 whether the first and further analysis signals are sufficiently stationary, i.e. that the dynamic changes in the plant are relatively small.

(47) As already described, an analysis signal in the form of a standard deviation is a measure of the variance of the data or a measure of the stationarity of the data, that is to say of the corresponding sensor signal. In order to ensure that only sufficiently stationary analysis signals are used in the further determination of an offset fault, the first analysis signal x.sub.1(t.sub.k) and the further analysis signal x.sub.2(t.sub.k) may be compared with at least one (specified) limit value std.sub.lim. The following comparison may be carried out in step 408:
x.sub.1(t.sub.k)<std.sub.lim
x.sub.2(t.sub.k)<std.sub.lim  (10)

(48) If the result of the comparison from (10) is positive, then it is possible to continue with step 410. In particular, the difference (=mean deviation Δm) between the sensor signals can then be determined in dependence on the analysis signals. In the case of a negative result of the comparison from (10), the procedure may be interrupted, in particular for as long as it takes for the check to produce a sufficiently positive outcome.

(49) In step 410, the mean deviation Δm, in particular the absolute value of the mean deviation Δm, of the measured values m of the sensor signals may be determined. In this case, allowance can be made for the correction value Δm.sub.correction determined in step 406. Preferably, the following calculation can be carried out by the processing device in step 412:
Δm=|m.sub.f,2(t.sub.k)−m.sub.f,l(t.sub.k)+Δm.sub.correction|.  (11)

(50) In step 412, the comparing device may compare the mean deviation Δm, in particular the absolute value of the mean deviation Δm, determined in step 410 with an admissible deviation. Preferably, the deviation Δm may be scaled in advance to the measuring range of the sensor. The following comparing operations can be carried out:

(51) $\begin{array}{cc}.Math.\frac{\Delta m}{\mathrm{measur}.\mathrm{range}}.Math.<{\mathrm{off}}_{\lim }.& \left(12\right)\end{array}$

(52) In particular, it is checked according to (12) whether the mean deviation Δm lies within an admissible range, that is to say does not exceed a (specified) limit value off.sub.lim. Depending on the result of the comparison, it is determined in particular by the evaluating device whether there is a faulty sensor. If the limit value off.sub.lim is exceeded, i.e. the deviation between the sensor signals therefore lies in an inadmissible range, one of the two redundant sensors has a fault, in particular an offset fault.

(53) In the next step 414, in the case of such a result of the comparison, a warning and/or an alarm may be output. For example, it may be provided that, to avoid a false alarm, first only a warning is output. If this warning is repeated over repeat.sub.offset successive sampling increments (where the process should continue to be stationary over the respective sampling increments (10)), an alarm concerning the incorrect behaviour of the pair of sensors may take place.

(54) FIG. 5 shows a diagram with a variation of a first sensor signal 532 and of a further sensor signal 534 given by way of example. The designation 536 identifies the point in time from which an offset fault occurs. It goes without saying that the variations shown are schematic variations.

(55) As already described, it may in addition or as an alternative be provided that a freezing fault of a sensor is detected by the method in that, depending on the analysis signals generated in step 404, a correlation is determined as set out below. In particular, the freezing calculation may be performed by way of an evaluation of the crosscorrelations of the two analysis signals.

(56) In step 416, a difference signal Δx may be determined from the first analysis signal x.sub.1(t.sub.k) and the further analysis signal x.sub.2(t.sub.k):
Δx=x.sub.2(t.sub.k)−x.sub.1(t.sub.k)  (13)

(57) As already described, freezing should be understood in the present case as meaning that the sensor signal from a sensor has frozen at a constant value, and consequently its standard deviation, that is to say the analysis signal, becomes zero.

(58) Then, in step 416, crosscorrelations between the difference signal Δx and the analysis signal x.sub.1(t.sub.k) from the first sensor and the difference signal Δx and the analysis signal x.sub.2(t.sub.k) from the further sensor may be analysed. For the analysis, the respective analysis signal (9) may for example be collected over an interval p with the length n.sub.freeze (e.g. 1000 measured values). When the interval p is filled with datapoints of the analysis signal, the crosscorrelations between the difference signal Δx and the analysis signal x.sub.1(t.sub.k) are calculated. This corresponds to the covariance cov.sub.x1,Δx,p between the analysis signal x.sub.1,p and the difference signal Δx p:
cov.sub.x1,Δx,p=cov(x.sub.1,p,Δx.sub.p).  (14)

(59) The crosscorrelations between the difference signal Δx and the analysis signal x.sub.2(t.sub.k) can be calculated in a corresponding way. This corresponds to the covariance cov.sub.x2,Δx,p between the analysis signal x.sub.2,p and the difference signal Δx.sub.p:
cov.sub.x2,Δx,p=cov(x.sub.2,p,Δx.sub.p).  (15)

(60) A detailed possible way of determining the covariance is described below. The covariance between the difference signal Δx and the analysis signal x.sub.1(t.sub.k) can be calculated as follows:

(61) $\begin{array}{cc}{\mathrm{cov}}_{x1,\Delta x,p}=\frac{1}{n_{\mathrm{freeze}}-1}\underset{i=1}{\overset{n_{\mathrm{freeze}}}{.Math.}}\left(x_1\left(t_{k-i+1}\right)-{\stackrel{\_}{x}}_{1,p}\right)*\left(\Delta x\left(t_{t-i+1}\right)-{\stackrel{\_}{x}}_p\right).& \left(16\right)\end{array}$

(62) The crosscorrelations between the difference signal Δx and the analysis signal x.sub.2(t.sub.k) can be calculated correspondingly:

(63) $\begin{array}{cc}{\mathrm{cov}}_{x2,\Delta x,p}=\frac{1}{n_{\mathrm{freeze}}-1}\underset{i=1}{\overset{n_{\mathrm{freeze}}}{.Math.}}\left(x_2\left(t_{k-i+1}\right)-{\stackrel{\_}{x}}_{2,p}\right)*\left(\Delta x\left(t_{t-i+1}\right)-{\stackrel{\_}{x}}_p\right).& \left(17\right)\end{array}$

(64) For the calculations, the average value x.sub.1,p of the first analysis signal x.sub.1(t.sub.k)

(65) $\begin{array}{cc}{\stackrel{\_}{x}}_{1,p}=\frac{1}{n_{\mathrm{freeze}}}\underset{i=1}{\overset{n_{\mathrm{freeze}}}{.Math.}}{x}_1\left(t_{k-i+1}\right)& \left(18\right)\end{array}$

(66) the average value x.sub.2,p of the further analysis signal x.sub.2(t.sub.k)

(67) 0$\begin{array}{cc}{\stackrel{\_}{x}}_{2,p}=\frac{1}{n_{\mathrm{freeze}}}\underset{i=1}{\overset{n_{\mathrm{freeze}}}{.Math.}}{x}_2\left(t_{k-i+1}\right)& \left(19\right)\end{array}$

(68) and the average value xp of the difference signal Δx

(69) $\begin{array}{cc}{\stackrel{\_}{x}}_p=\frac{1}{n_{\mathrm{freeze}}}\underset{i=1}{\overset{n_{\mathrm{freeze}}}{.Math.}}\Delta x\left(t_{k-i+1}\right)& \left(20\right)\end{array}$

(70) are calculated. This calculation may be carried out as soon as the current interval is filled with n.sub.freeze data or measured values. When the interval and the freezing calculation have been completed, the current data (of the current point in time) can be collected for the next interval until there are again n.sub.freeze data.

(71) Subsequently, in step 416, the ratio of the two crosscorrelations cov.sub.x1,Δx,p and cov.sub.x2,Δx,p is determined as a correlation. The ratio may be compared in a comparing step 418 with an admissible (specified) ratio range. For example, a limit value ratio.sub.freezing,tol (e.g. ratio.sub.freezing,tol=1000) may be specified. If the ratio lies within the admissible ratio range, there is no fault. Otherwise, it can be deduced that there is a faulty sensor. If there is a fault, it is possible in particular for the defective sensor to be identified as follows. If

(72) $\begin{array}{cc}.Math.\frac{{\mathrm{cov}}_{x1,\Delta x,p}}{{\mathrm{cov}}_{x2,\Delta x,p}}.Math.>{\mathrm{ratio}}_{\mathrm{freezing},\mathrm{tol}}& \left(21\right)\end{array}$

(73) then the ratio lies in a further inadmissible sub-range. The further sensor is defective (frozen). If

(74) $\begin{array}{cc}.Math.\frac{{\mathrm{cov}}_{x2,\Delta x,p}}{{\mathrm{cov}}_{x1,\Delta x,p}}.Math.>{\mathrm{ratio}}_{\mathrm{freezing},\mathrm{tol}}& \left(21\right)\end{array}$

(75) then the ratio lies in a first inadmissible sub-range. The first sensor is defective (frozen).

(76) In these cases, a warning and/or an alarm may be output in step 420. For example, it may be provided that, to avoid a false alarm, first only a warning is output. In particular, if (21) or (22) is satisfied, a warning for the respective sensor may be output. If this warning is repeated over (specifiable) repeat.sub.freezing successive intervals, an alarm concerning the incorrect behaviour of the identified sensor may take place.

(77) FIG. 6 shows a diagram of a first analysis signal 638 given by way of example, a further analysis signal 640 given by way of example and a difference signal 642 resulting from these signals 638, 640. The designation 644 represents the point in time from which the further sensor is frozen; the resultant analysis signal therefore gives 0. As can be seen, the analysis signal of the further signal correlates with the difference signal of the analysis signals. From this it can be deduced that the first sensor is frozen. It goes without saying that the variations shown are schematic variations.

(78) As already described, it may in addition or as an alternative be provided that a fouling fault of a sensor is detected by the method. The detection of a fouling fault may likewise be performed by way of an evaluation of the crosscorrelations of the two analysis signals. It may be based on a maximization of the covariance between the analysis signals. The analysis signals described above of the two redundant sensors may be stored over an interval q with a length (n.sub.fouling+2*z.sub.max). In particular, the interval q has been extended by the data 2*z.sub.max. In the present case, 2*z.sub.max represents the search domain of the fouling calculation presented below. In the present case, n.sub.fouling represents the length of the actual core of the interval q. The fouling analysis may be carried out as soon as the interval q is filled with data. It is important for the fouling calculation that there is a meaningful set of data in the interval q, characterized by sufficient dynamics in the data. Therefore, the core of the interval n.sub.fouling must be chosen to be sufficiently long, so that time intervals in which the process is running in a stationary state can be bridged. The length n.sub.fouling of the core of the interval may be chosen to be constant. Alternatively, the length n.sub.fouling may also be kept variable. The length may be calculated here by way of an optional calculation that can be carried out in step 424 in such a way that the data are excited by sufficient dynamics in order to make an even more reliable fouling fault detection possible.

(79) In particular, after generating a first analysis signal and a further analysis signal, in step 422 the following determination may be carried out:

(80) The aim of the determination is in particular that in both the analysis signals there are respectively datapoints with sufficient dynamics in the interval. A dynamic measuring datapoint is characterized here by dynamic behaviour in comparison with its neighbouring measuring datapoints, i.e. that the first derivative with respect to time at the datapoint considered is not constant, the process value or measured value therefore does not rise (or fall) with a constant slope or is stationary. The second derivative is a measure that the first derivative with respect to time at the datapoint considered is constant.

(81) The determination in step 424 for calculating the interval length investigates in particular the second derivative of a datapoint or measured value with respect to time. This involves using the signal of the filtered measured value m.sub.f,k (6).

(82) For the datapoint m.sub.f,k at the point in time t.sub.k, it is possible to calculate the second derivative Δ.sup.2m.sub.f,k with the sampling time T.sub.samp with the aid of the neighbouring datapoints m.sub.f,k-1 at the point in time t.sub.k-1, and m.sub.f,k-2 at the point in time t.sub.k-2:

(83) $\begin{array}{cc}{\Delta }^2{m}_{f,k}=\frac{m_{f,k}-2m_{f,k-1}+m_{f,k-2}}{T_{\mathrm{samp}}^2}.& \left(23\right)\end{array}$

(84) Datapoints that satisfy the condition for non-dynamic behaviour, e.g.:
|Δ.sup.2m.sub.f,k|<ε.sub.dyn  (24)
can be collected in the dataset n.sub.fouling,non-dyn.Math.ε.sub.dyn is a small positive (specifiable) tolerance, which in the present case serves as a measure of dynamic behaviour.
n.sub.fouling,non-dyn|(|Δ.sup.2m.sub.f,k)|<ε.sub.dyn  (25)

(85) The n.sub.fouling,non-dyn datapoints in the interval q are not particularly suitable for fouling detection. The data that are sufficiently dynamic, that is to say do not satisfy condition (24), are collected in the dataset n.sub.fouling,dyn:
n.sub.fouling,dyn|(|Δ.sup.2m.sub.f,k|≥∈.sub.dyn).  (26)

(86) If non-dynamic datapoints are detected in an interval q, the length n.sub.fouling of the core of the interval q may be increased in such a way that the (specified) dynamic condition that at least n.sub.fouling,dyn,min dynamic datapoints are contained in the interval q for at least one sensor is satisfied. Preferably, the dynamic condition is demanded for both sensors, as set out in formula (27).
n.sub.fouling>max*(n.sub.fouling,non-dyn,s+n.sub.fouling,dyn,min).  (27)

(87) The index s stands here for the first sensor or the further sensor. In other words, there must preferably be sufficient dynamic datapoints or measured values for both sensors in the interval q.

(88) In step 426, the crosscorrelation between the two sensors can then be maximized by the processing device, in that the first analysis signal from the first sensor is displaced in comparison with the further analysis signal of the further sensor in such a way that the two analysis signals are made to coincide.

(89) In particular, the maximization of the crosscorrelation can be achieved by the covariance between the first analysis signal and the further analysis signal over the interval q being maximized on the basis of the displacement of the further analysis signal. The displacement of the further analysis signal may be performed by way of z time increments in the negative or positive direction. The covariance cov.sub.q in the interval q can be maximized as a degree of freedom with the aid of z, where z is the number of time increments by which the further analysis signal is displaced. The displacement z may be restricted by [−z.sub.max, z.sub.max]. In the interval q, the covariance cov.sub.q is calculated with the aid of the analysis signals:

(90) $\begin{array}{cc}\underset{z}{\max }{\mathrm{cov}}_{q}s.t.{\mathrm{cov}}_q=\mathrm{cov}\left(x_1\left(t_{k-z_{\max }}\right),\mathrm{.Math.},x_1\left(t_{k-n_{\mathrm{fouling}}+1-z_{\max }}\right),x_2\left(t_{k-z_{\max }+z}\right),\mathrm{.Math.}{x}_2\left(t_{k-n_{\mathrm{fouling}}+1-z_{\max }+z}\right)\right)z\in \left[-z_{\max },z_{\max }\right].& \left(28\right)\end{array}$

(91) In particular, the maximization for the first analysis signal x.sub.1 and the further analysis signal may take place as follows:

(92) $\begin{array}{cc}\underset{z}{\max }{\mathrm{cov}}_{q}s.t.{\mathrm{cov}}_q=\frac{1}{n_{\mathrm{fouling}}-1}\underset{i=1}{\overset{n_{\mathrm{fouling}}}{.Math.}}\left(x_1\left(t_{k-i+1-z_{\max }}\right)-{\stackrel{\_}{x}}_{1,q}\right)*\left(x_2\left(t_{k-i+1-z_{\max }+z}\right)-{\stackrel{\_}{x}}_{2,q}\right)z\in \left[-z_{\max },z_{\max }\right],\mathrm{where}& \left(29\right)\\ {\stackrel{\_}{x}}_{1,q}=\frac{1}{n_{\mathrm{fouling}}}\underset{i=1}{\overset{n_{\mathrm{fouling}}}{.Math.}}{x}_1\left(t_{k-i+1-z_{\max }}\right)\mathrm{and}& \left(30\right)\\ {\stackrel{\_}{x}}_{2,q}=\frac{1}{n_{\mathrm{fouling}}}\underset{i=1}{\overset{n_{\mathrm{fouling}}}{.Math.}}{x}_2\left(t_{k-i+1-z_{\max }+z}\right).& \left(31\right)\end{array}$

(93) The fouling time r may be determined as a correlation condition from the performed displacement z, that is to say the number z of datapoints by which the further analysis signal x.sub.2 has been displaced, and the sampling time T.sub.sample. For example, the fouling time r may be calculated as follows:
τ=T.sub.sample*z.  (32)

(94) In a comparing step 428, this correlation condition may be compared with an admissible fouling time range.
|τ|>τ.sub.warn  (33)

(95) Depending on the result of the comparison, it is determined whether there is a faulty sensor. If the limit value τ.sub.warn is exceeded, the correlation condition therefore lies in an inadmissible range, one of the two redundant sensors has a fault, in particular a fouling fault.

(96) In the next step 430, a warning and/or an alarm may be output. For example, it may be provided that, to avoid a false alarm, first only a warning is output. If this warning is repeated over (specifiable) repeat.sub.fouling successive intervals, an alarm concerning the incorrect behaviour of the pair of sensors may take place.

(97) FIG. 7 shows a diagram given by way of example with a first analysis signal 746, a further analysis signal 750 and the analysis signal 748 displaced by 752. Here, 752 is the time constant resulting from the calculation, which is referred to as the fouling time. It goes without saying that the variations shown are schematic variations. The designation 754 denotes the search domain.