Control validation, limits, faults and human supervision

Define what a successful test would establish

Verification checks whether the implementation follows its specified equations, sequencing and timing. Validation asks whether the resulting system meets its intended need under stated conditions. A simulated nominal trace addresses only part of that argument. Define the reference, allowed physical error, disturbance range, initial states, constraints and measurement uncertainty before scoring a result.

Use observations independent enough to challenge the loop’s own sensor and conversions. Shared calibration, clocks or power can create common errors in apparently redundant channels. A precise repeat of the controller’s displayed value does not establish an independent measurement if both values came from the same stored sample.

Examine plausible failure paths and recovery

A sensor can drift, freeze, become intermittent or report a plausible value in the wrong unit. Communication can deliver delayed, reordered or duplicated information. An actuator can fail to follow its request. Tests should distinguish acquisition freshness, message freshness and agreement with physical evidence. Thresholds require an uncertainty and response-time rationale, rather than being selected only to pass nominal data.

Recovery is a separate behaviour. Resetting an alarm, restoring communication or restarting software does not establish that the physical process is ready to resume. Stored integral states and active sequence states can affect the first action after recovery. Define permitted modes, the evidence for transitions and who has authority to supervise them.

Keep protection and human decisions in view

A normal process controller regulates production or service. A protective function is intended to reduce risk under specified abnormal conditions and needs its own justified design and evidence. A stability calculation for the normal loop is not that evidence. The appropriate response to a fault depends on the process; removing every source of power is not universally a safe state.

An operator needs understandable mode, data age, limits and reason for a hold or alarm. An alarm acknowledgement should not masquerade as correction of the cause. Test records should preserve failures and untested cases alongside passes. A fraction of planned tests passed describes that test set; it is not an estimate of operational reliability or probability of safe performance.

A reported zero error fails an independent check

At times 0, 1, 2 s a fictional loop targeting 5 m/s receives 5, 5, 5 m/s. An independent reference at the same physical location gives 5, 4, 3 m/s. The indicated error remains zero while physical disagreement increases to 2 m/s. A frozen measurement is one hypothesis; scaling, reference validity and timing also need investigation.

Separately, suppose a small planned test set has three cases: nominal 5.0 m/s, imposed-load 4.9 m/s and a fault case 3.0 m/s, against a stated physical band 4.8–5.2 m/s. The first two pass and the third fails: 2 of 3 planned cases, with the failure retained. That count does not qualify a control system for use.

Try the reasoning

1. Fresh communication timestamps accompany an unchanged value. Is the measurement fresh?

   Show the answer and reasoning

   Not established. A sender can retransmit a stored value; acquisition time and the sensing path need separate evidence.

2. Can increasing integral gain correct the frozen-sensor problem?

   Show the answer and reasoning

   No. The controller sees zero error and lacks the physical information. Changing gain is not a substitute for fault detection and a justified response.

3. Do two passing tests cancel a failing fault test?

   Show the answer and reasoning

   No. Each requirement and case retains its own result. Aggregating the count cannot demonstrate that the failed requirement has been met.

What to carry forward

A useful control claim connects physical evidence, implementation, abnormal conditions and supervised recovery.