Sensor Devices with High Metrological Reliability

At present, a great number of embedded sensor devices provide monitoring of operating conditions and state of equipment, including nuclear reactors of power plants. The metrological reliability of measuring instruments built in equipment determines the validity of measurement information. The quality of production, operating costs, and the probability of accidents depend on the validity of measurement information coming to control systems. The validity is particularly important in such fields as nuclear power engineering, cosmonautics, aviation, etc. For some products in definite periods of their operation, even a short-term loss of confidence in measurement accuracy is unacceptable. The key problems of the measurement information validity are related to the sensor metrological reliability, since their components age and their parameters drift with time. Sudden failures can also happen. All this can result in control errors. The sensor devices used to monitor the condition of technological equipment and the parameters of a technological process, are, as a rule, subject to a variety of influencing quantities. Possible consequences of these influences are, for example, depositions, magnetization, and so on. In some cases, the effect of the influence quantity can be weakened by a careful design of the sensor. For example, the rate of fouling of a sensor surface can be reduced by polishing the surface. However, it is not always possible to develop a sensor device immune to influencing factors over a long period of operation. Sometimes, economic reasons may play a role as well. At present, the traceability of measurements is provided by periodic calibrations or verifications (hereinafter both of these procedures will be referred to as calibrations). Accordingly, within the period of operation the probability of a metrological failure depends on the length of the calibration interval (CI). The state of a secondary transducer can be verified by supplying electrical signals of reference values to its inputs. As demonstrated in (Fridman, 1991), between 40% and 100% of all measuring instrument failures are due to metrological failures. Improvements in production quality result in decrease of the number of failures, the share of metrological failures being increased because with the technology improvement the share of sudden failures decreases. It is not expedient to apply fundamental assumptions of the classical reliability theory (e.g., mutual independence of failure rates and stability of a failure rate) to measuring instruments. Usage of methods based on these assumptions leads to crude errors in the CI determination. To decrease the risk of getting unreliable information, usually the CI is no more than 2-3 years. However, the cost of a sensor device calibration is typically 35–300 euro, and the


4
number of sensor devices is growing year by year. If a CI duration is constant, the proportion of operating costs spent on calibration will rise to an unacceptable level. In many cases, it is necessary to disrupt a technological process in order to carry out sensor device calibration. Such interference leads to additional costs. The standard (ISO/IEC, 1999) states that it is ''the responsibility of the end-user organization to determine the appropriate calibration interval under the requirements of its own quality system". The guidelines (OIML, 2007) state that ''the initial decision in determining the CI is based on the following factors:  instrument manufacturer's recommendation;  expected extent and severity of use;  the influence of the environment;  the required uncertainty in measurement;  maximum permissible errors (e.g., by legal metrology authorities);  adjustment of (or change in) the individual instrument;  data about the same or similar devices, etc." Furthermore, it is recommended to adjust the initial CI for the process of operation ''in order to optimize the balance of risks and costs", due to a number of reasons, for example:  the instruments may be less reliable than expected;  the operating conditions may vary significantly from the manufacturer's recommended ranges, requiring an adjustment to the CI;  the level of drift determined by instrument recalibration can demonstrate that longer CIs are possible without any increase of risk;  it may be sufficient to carry out a limited calibration of certain instruments instead of a full calibration, etc. However, in some cases, it is impossible to perform calibrations with a short CI, in order to obtain the data necessary for adjusting the CI value for the measuring instrument. For many modern complex technical processes, the mean value of continuous running grows. At present, for some processes the campaign duration has to be no less than 10 years. Measuring instrument operation conditions can vary considerably over the course of several CIs. In industrial equipment, they can appreciably vary when upgrading the technological process, e.g., in case of production modernization. Operation conditions for sensor devices in ship nuclear power sets will depend on the intensity of the equipment use. For all the reasons given above, the end user does not want or has no possibility of affording the testing of each measuring instrument in order to provide grounds for optimizing the CI. Calibrations are expensive, but as the experience shows, the majority of measuring instruments (according to various estimates which vary from 60% to 80% for all instruments submitted for calibrating) does not need it. However, approximately 12% of measuring instruments have an error exceeding the permissible limits within the CI. The contradiction is obvious. To reduce the costs associated with the interruption of a technological process and the calibration of built-in measuring instruments, it is desirable to calibrate as seldom as possible. However, unreliable information received by a control system from measuring instruments, can cause failures and large economic losses. To prevent this, it is necessary to check the measuring instrument state as often as possible. It is impossible to settle this contradiction using trivial methods of calibration.

5
This chapter deals with non-conventional methods of improvement of the measuring information validity and possibilities to increase the sensor device metrological reliability on the basis of these methods.

Way to solve the problem. Self-check in biological and technical sensor systems
Various attempts have been made to decrease the labour costs of instrument calibration: in some cases calibration is performed without dismantling the sensor. For example, in (Karzhavin et al., 2007) it was proposed to design the thermocouple housing with an additional hole and to periodically insert a thin reference thermocouple into this hole. Such periodical sensor calibration procedures are an additional load for personnel. They may result in bending or damaging of the thermocouples or sensor displacement from the required location. All these undesirable outcomes may result in calibration errors. In some sensors, a ''live zero" correction is made. For example, in a pressure sensor this can be performed by ''switching off" the pressure measured. However, such a procedure does not reveal and correct a multiplicative error. Both of the above proposals cannot ensure checking the ''metrological health'' of a sensor within the CI. One possible solution of the problem is suggested by taking into account the qualitative difference in the goals which metrologists try to achieve at various stages of the life cycle of a measuring instrument. The initial calibration of a sensor on completion of its manufacture is aimed at establishing and specifying the parameters corresponding to a ''normal condition" of the sensor. At the stage of online operation, the goal is different. It consists in revealing a metrological failure, i.e. deviation of the parameters from their initial values registered at the initial calibration, and, if possible, in correcting them. This goal can be achieved using unconventional methods. In order to find possible ways to solve a problem it is necessary to have a criterion. Professor Wiener (Wiener, 1948) and the outstanding philosopher and writer Mr. Lem (Lem, 1980) demonstrated the value of applying an analogy between technical and biological systems. This analogy is very successfully being developed in evolutionary cybernetics (Red'ko, 2007;Turchin, 1977), as well as in bionics (biomimetics). As applied to sensors, a biomimetic approach enables to realize functions, structural elements and other features which mimic similar designs ''discovered" by nature in the past (Bogue, 2009;Stroble et al, 2009). In our opinion, the similarity between the biological and technical evolutions forms not only a ''reference book" containing successful structural and functional decisions. In the case of metrology, it gives a necessary strategic criterion for development of measuring instruments and systems with high metrological reliability. The time scales of biological evolution and of sensor device development are different. However, the tasks solved were similar: with time, the methods providing the survival in the nature and the methods providing metrological reliability of sensor devices built in the equipment intended to be used under changing environmental conditions, were improved. In the early period, prolonging of life was achieved through the use of conservative methods of enhancing the "reliability". For example, protection of a turtle with a shell or protection of a sensor device with a sheath, certainly could prolong their life span. However, the ambient conditions of measuring instruments as well as those of living organisms are characterized by a significant level of unpredictability. Adaptive methods allow to take into account the variability of the environment (Taymanov & Sapozhnikova, 2010b). The adjustment of the insulating properties of an animal's pelt with the season increases the likelihood of survival under a changing environment, as does the active thermoregulation of measuring instruments. The appearance and growth of biological intelligence relate to ensuring the survival under increasingly rapid environmental changes. Intelligence enables to forecast and take into account future changes of dangerous character, including those of an intelligence carrier state. ''Evolutionary change is not a continuous thing; rather it occurs in fits and starts, and it is not progressive or directional''. On the other hand, evolution ''has indeed shown at least one vector: toward increasing complexity'' (McFarland, 1999). Developing the idea of the analogy between biological and technical evolution, it is possible to consider a direct analogy between the life span of a living organism and the lifetime of a measuring instrument, during which the measuring instrument is characterized by metrological serviceability and the absence of any maintenance requirement. Then the purpose of artificial intelligence in a measuring instrument can be defined as ensuring the reliability of measurements for an extended lifetime. To achieve this ultimate purpose, it is necessary to analyze ''metrological health", to forecast future ''behavior", as well to provide a correction of an error and self-recovery of a measuring instrument. The idea of applying ''intelligence" for increasing the reliability of measurement information formed by measuring instruments, appeared and started developing not long time ago. At this stage of technical evolution, it became necessary to extend considerably the lifetime of the ''weak points'' of measurement instruments. These ''weak points'' are sensor devices. At the same time, it became possible to solve this problem at the expence of the increase in the complexity of a sensor device. Intelligence in the nature has developed in two ways: the formation of a ''collective mind" consisting of many living organisms, and the development of the intelligence (mind) of a separate individual. If the risk of extinction of individual living organisms is high, the ''collective mind" provides a way of preserving the experience gained and supporting the life of the species as a whole. Certainly, just such a type of intelligence started forming at the early stages of evolution, when the life span of an individual organism was short. A representative example is given by the swarming insects, i.e., the bees, which select reliable information by ''voting". The validity of information obtained by scout bees, depends on the number of bees obtained this information. Formation of the ''collective mind" is the integration of a number of autonomous subsystems at a lower level (they can be different, to some extent) and the development of an additional control mechanism at a higher level (Red'ko, 2007). A similar approach to checking the reliability of information is applied in metrological practice. In nuclear power plants, a redundant number of sensors are integrated into a multichannel measuring system. In this case, the metrological malfunction of a sensor can be detected on the basis of deviation of its signal from the signals of the remaining sensors of the system, the readouts of the most part of sensor devices being considered to be reliable (Hashemian, 2006). However, it is not always possible to form a significantly large ''swarm" of sensors to measure the same quantity. Information coming from a group of the sensors comprising a ''swarm", can also be distorted by external factors. Signals from a significant part of the ''swarm" may come with some delay that can lead to erroneous decisions, etc.

7
The results of ''metrological health" checks in a multichannel system of the sensor devices measuring different, but correlated values of the same or various quantities, have an additional error component caused by the measurement method. Its value depends on the accuracy of the relationship between the values of measurands. It is possible to decrease the above error component by making the values of measurand field characteristics closer to each other. The same is related to characteristics of the fields of influencing quantities. However, this procedure requires a considerable amount of costly time and effort, particularly if it is necessary to perform measurements at several points of a given measurement range. In comparison with the ''collective mind", the intelligence of an individual has an advantage in searching for effective ways to survive under a changing environment. The ultimate check of ''metrological sensor parameters" deviation has been realized by humans and other creatures with a developed personality. In addition to the minimum of ''sensors" for the quantity to be measured, each sense organ is provided with supplementary sensors. The brain has a special mechanism for testing the stability of essential activity characteristics. This mechanism, known as an ''error detector", has been discovered by the famous Russian Academician Bekhtereva (Bekhtereva, et al., 2005). A person diagnoses a ''malfunction" of a sense organ such as an eye or ear, initially, through an unpleasant sensation caused by signals coming from these supplementary sensors. It should be noted that to provide the selection of video-or audio-information, these supplementary sensors are not required and in this implication they are redundant. Similarly to the sense organs of intelligent living creatures, a measuring instrument with artificial intelligence distinguishes by the following features:  it contains one or more basic sensors, as well as additional elements, e.g., additional sensors;  these sensors and elements enable the generating and processing a measurement signal as well as a number of additional signals which carry information about the ''metrological health" of a measuring instrument. Besides the method discussed, a living organism applies auxiliary ways for detecting deterioration in the functioning of individual sense organs, namely, analysis of video-, audio-and other information, coming through all organs of sense as well as analysis of the response of other members of a society. In biological evolution, both types of intelligence considered above are developing in parallel. Sometimes, they supplement each other, but the intelligence of an individual has gained the priority and greatest pace of improvement. By the analogy, in technical set, it is the most perspective to apply the sensors with the individual "intelligence", joint in the system with the ''collective mind".

Metrological self-check
In a number of publications, the experience has described, which demonstrates the methods of sensor device serviceability monitoring on the basis of joint processing of the data obtained in multichannel measuring system (e.g., GOST R, 1996;Hashemian, 2005Hashemian, , 2006. Development of sensor devices with a structure that enables, to some extent, to control their metrological serviceability within the process of operation has been started in Russia since 1980s (Druzhinin & Kochugurov, 1988;Sapozhnikova, 1991;Sapozhnikova et al., 1988;Tarbeyev et al., 2007). Later on, such activity was also expanded in the UK and USA as well 8 as in Germany, China and other countries (Barberree, 2003;Hans & Ricken, 2007;Henry & Clarke, 1993;Henry et al., 2000;Feng et al., 2007Feng et al., , 2009Reed, 2003;Werthschutzky & Muller, 2007;Werthschutzky & Werner, 2009). In general, the above works are of an heuristic character. This circumstance impedes estimation of their efficiency. Below, the methodology concept is considered, which enables developing the measuring instruments with a high metrological reliability provided by metrological serviceability checks and additional measures realized on the basis of such checks.

General terms and their definitions
The terms and definitions given below were presented at a number of international conferences, discussed with specialists of many Russian organizations, and included into the national standard of Russia, developed by the authors (GOST R, 2009). The most part of these terms was given in (Taymanov & Sapozhnikova, 2009, 2010b. Taking into account the above and availability of those papers, there are no detailed explanation of the terms and their definitions here. Sensor: an "element of a measuring system that is directly affected by a phenomenon, body, or substance carrying a quantity to be measured" (VIM, 2008). Sensor device ("datchik"): a constructively isolated (separate) unit that contains one or a number of sensors. (Further in this chapter, the term "sensor device" is applied. The term "datchik" is given here to facilitate understanding of the content of some publications referred below.) The sensor device can include secondary measuring transducers and material measures. Adaptive sensor device: a sensor device the parameters and/or operative algorithms of which can change in the process of operation subject to signals from sensors, secondary transducers and material measures it contains. Metrological serviceability of a sensor device in the process of operation: a state for which an error specified for this sensor device under operating conditions lies within some specified limits. Critical error component: the most "dangerous" error component, i.e., a predominant error component or component tending to rise quickly. This component determines mostly a risk of getting an unreliable result of measurement. It can be revealed by analysis of the experimental investigations results as well as of scientific and technical information. Metrological self-check of a sensor device: an automatic procedure of testing the metrological serviceability of a sensor device in the process of its operation, which is realized using a reference value generated with the help of an additional (redundant) embedded element (a sensor, secondary transducer, or material measure) or additional parameter of an output signal. The term "reference value" corresponds to the term given in (VIM, 2008). The reference values are determined and specified at the stage of a previous calibration. (Often, they use the term "self-monitoring" instead of the term "self-check". At the same time, the metrological self-check accompanied by evaluation of error or uncertainty is usually called "self-validation"). Correction of the sensor device characteristics can be made on the basis of the metrological self-check results if an error nature (multiplicative or additive) is known. The results of the metrological self-check can be applied as a basis for increasing or reducing the value of a calibration interval as well as for making forecasts of a remaining life time. The metrological self-check is realized in a continuous or test mode and performed in two forms, i.e., in the form of a direct or diagnostic self-check.
Test mode of metrological self-checking of a sensor device: connection of a sensor or secondary transducer to an additional built-in sensor or built-in material measure, or injection of a test signal the relationship between which and a measurand or its variation is known with a required accuracy. The test mode assumes an interruption of an applied measurement procedure for a time interval within which the procedure of testing is performed. Metrological direct self-check of a sensor device: a metrological self-check performed by evaluating the deviation of a measured value from a reference value generated by an additional (redundant) element (by a sensor or material measure) of a higher accuracy. Therefore, it provides an automatic check of the total error of a sensor device under operating conditions. Metrological diagnostic self-check of a sensor device: a metrological self-check performed by evaluating the deviation of a diagnostic parameter characterizing the critical error component from the reference value of this parameter, established at the stage of a previous calibration. The metrological diagnostic self-check is performed without any embedded elements of a higher accuracy. Data-redundant sensor device: a sensor device enabling to generate a diagnostic parameter on the basis of an additional output signal parameter or of a built-in means. In case of connecting such a sensor device to a signal processing unit, the latter can provide realization of the metrological self-check function. Intelligent sensor device: a sensor device with the function of the metrological self-check. Reliability of metrological self-check of an intelligent sensor device: a qualitative estimate indicating the level of a risk to get the results of metrological self-check of a sensor device, which are inconsistent with an actual condition of this sensor device.

Metrological self-check methods
In (Henry & Clarke, 1993), a group of methods which can be applied to detect and identify the faults of a sensor or system of sensors and actuators, is given. These methods are based on analytical redundancy, a priori knowledge, or measurement aberration detection. Analytical redundancy exploits the implicit redundancy in the static and dynamic relationships between measurements and actuator inputs using a mathematical model. A priori knowledge relate to information "concerning operational conditions and associated fault modes, patterns of signal behaviour characteristic of particular faults, or historical fault statistics". Measurement aberration detection permits to reveal faults, taking into account how they change the behaviour of the signal (e.g., bias, noise, etc.). A self-validating Coriolis flow meter developed on the basis of the above sources of additional information provides the self-diagnostics and diagnostics of corresponding actuators, the result of measurements being accompanied by a value of uncertainty (Henry et al., 2000). In (Feng et al., 2007), sources of information intended for diagnostics of sensor device faults are classified in the following way:  hardware redundancy (e.g., combination of a thermocouple and resistance thermometer);  analytical redundancy taking into account a known relationships between the signals of several sensors or the signals of sensors and parameters of a technological process model;  information redundancy of a sequence of sensor device signals which is revealed with the help of mathematical methods.
In the publications of the authiors of this chapter (Taymanov & Sapozhnikova, 2009, 2010a, 2010b, it is emphasized that the metrological self-check can be realized only on the basis of the redundancy that can be just of temporal, spatial, and informational type. The redundancy of the above types can be used separately as well as in any combination. Correspondingly, the methods permitting to organize the metrological self-check are subdivided in accordance with the types of redundancy. The spatial redundancy is provided by usage of additional sensors, secondary transducers, and/or material measures which occupy in a sensor device housing or directly in a measurement zone an additional space that is comparable with a minimally required one. Since these additional elements complicate the intelligent sensor device structure (as compared with its trivial non-intelligent analogue), the spatial redundancy is often named as structural. This term is accepted by the authors and will be used bellow.
The temporal redundancy is provided by additional measurement operations, which should be carried out at a frequency or within the range of frequencies exceeding a corresponding minimal value required to perform measurements with a specified accuracy. The informational redundancy is provided by using an additional dependence of a certain parameter of a sensor device signal on a measurand. Since all types of redundancy provide additional information, necessary to perform the metrological self-check, hereinafter the term "informational redundancy" is replaced by the term "functional redundancy". "External" information which is known for a specific equipment and mode of its operation (variation limits for parameters of a sensor device signal, correlation between the signals of various sensors and actuators, etc.) should be considered as a kind of the functional redundancy too. It should be noted that the accuracy of this "external" information is usually low. In a number of cases, it is subjected to interferences due to the remoteness of various sensor devices and actuators from each other. Application of these data is laid on customers. The competence of the customers in the field of the metrological self-check organization gives basis for doubts. The functional redundancy based on the " external" information can help to detect crude faults of sensor devices and to perform the equipment trouble-shooting. However, it is not very efficient for evaluating the sensor device metrological serviceability. The metrological self-check (self-monitoring or self-validation) can be also organized in a multichannel measuring system containing a set of sensor devices on the basis of the types of redundancy considered above. However, in (Taymanov & Sapozhnikova, 2010a) it is shown that the metrological self-check of autonomous sensor devices is the most efficient means, and the self-check provided in a system of sensor devices can be a useful addition to it.

Direct metrological self-check. Essence and specific features
In organizing the direct metrological self-check, it is necessary to have arguments according to which a sensor or material measure, used as a reference measurement standard, is more reliable as compared with a sensor, the metrological serviceability of which is checked. As a rule, the attempts to realize self-checking in such a form meet some limitations concerning a kind of measurand, a speed and range of its variation, and others. A typical example of the direct self-check realized in the test mode on the basis of both structural and temporal redundancy, is the eddy current sensor device of distance to a conducting surface of a target (Druzhinin & Kochugurov, 1988). This sensor device contains a drive inductance coil, sensor coil and target simulator made in the form of a switched flat inductance coil. The simulator is fixed between the drive coil and target. The piece fixing the distance between the drive coil and simulator serves as a length measure. The simulator coil being open (disconnected), the distance to the target is measured using a signal received by the coil. In the test mode, the simulator coil is closed, and it becomes a shield for the target. The output signal in this situation is assumed to be the diagnostic parameter. It is possible to estimate the metrological serviceability of the sensor device on the basis of the deviation of the diagnostic parameter determined in the process of sensor device operation from the reference value of the diagnostic parameter measured at the stage of a previous calibration. In a temperature sensor device, the direct self-check is realized in the continuous mode on the basis of redundancy of structural and temporal types (Bernhard et al., 2003). In this sensor device, there is an embedded cell (capsule) with a metal, the fixed point of which is known with a high accuracy. This fixed point is taken as the reference value. When the environment, the temperature of which is measured, is heated or cooled and the metal melts or hardens in the capsule, the speed of measured temperature changes significantly decreases, forming a "plateau" in a diagram "temperature -time". When the speed of temperature variation does not exceed a certain permissible minimum value that allows to register the "plateau", then it is possible to estimate the metrological serviceability of the sensor device on the basis of the deviation of the temperature value measured in the metal fixed point from the reference value. It is possible to apply correction of the sensor device characteristic on the basis of the evaluated deviation only if the type of the originated error (additive or multiplicative) is known. Nevertheless, the application of the direct self-check in such cases enables the time interval between calibration procedures to be increased, since the metrological reliability of the applied additional material measures can be assumed to be greater than that of the sensors contained in the sensor device. Direct self-check can be useful for increasing the reliability of measuring the parameters of dynamic processes. In particular, if a range of the temperature to be measured is significantly wide and there is a need to trace its relatively fast changes, the reliability of measurements can be increased by applying a sensor device with structural redundancy. In this case in a sensor device body, in addition to a low-inertial sensor (thermocouple), it is necessary to place a more inertial platinum resistance thermometer (PRT) being at the same time more precise (Barberree, 2003). The latter will act as a reference measurement standard. Within the time intervals when the speed of measured temperature variation is so low that it does not significantly affect the error of temperature measurements made with PRT, the values obtained with the PRT are used as the reference ones. As a result, a sensor device of such a type can provide measurements with a time lag close to the thermocouple one, but with the accuracy typical for the PRT. Sometimes, direct self-check can be realized on the basis of functional redundancy. For example, in any PRT both the resistance and parameters of its output noise spectrum depend on temperature. The temperature measurements made in terms of noise spectrum parameters are more accurate than those made in terms of resistance. That is why a value of the temperature measured in terms of a noise spectrum can be taken as a reference value. However, measurement of temperature on the basis of the noise spectrum requires for much more complicated unit for data processing. The direct self-check is analogous to the conventional calibration procedure. The only difference consists in performing the procedure with the help of the built-in reference measurement standards available in an apparent or implicit (as in the last example) form.

Metrological diagnostic self-check. Essence and specific features
The self-check of such a type is a qualitatively new procedure in providing the traceability of measurements. To select a diagnostic parameter characterizing the critical error component, it is necessary to measure two or a number of original parameters, the values of which depend on the value of a measurand to be determined by a sensor device. At the same time, these original parameters depend on factors causing the growth of the critical error component in different ways. Additional procedures of measurements are organized on the basis of structural, temporal, or functional redundancy revealed or introduced in a device that should be capable to perform the metrological diagnostic self-check (MDSC). The MDSC does not assume any usage of reference measurement standards of a higher accuracy. The additional sensor or material measure can have the metrological reliability that is close to that of the sensor, metrological serviceability of which is under checking. The same statement can be related to the accuracy of them. When the critical error component of duplicate sensors is drift, which for a group of sensors is characterized by a random distribution of the level and sign, the MDSC can be organized by arranging these sensors in a sensor device. In this case, it is possible to use a mean value of the deviation of output signal values from a mean value of the output signals as a diagnostic parameter. The metrological diagnostic check can be performed by estimating the difference between the diagnostic parameter values estimated in the process of operation and at the stage of a previous calibration. However, in addition to the random deviation of the duplicate sensor parameters combined in a sensor device, a monodirectional drift of the same parameters, which cannot be revealed, may take place. In this case, the efficiency of the MDSC can be increased by application of the sensors similar in the accuracy but differing in their design, production technology and /or principles of operation. The probability that an error of such sensors will change equally, is very small. The MDSC based on the structural redundancy in the test mode is realized, for example, in a pressure sensor device suggested in (Lukashev et al., 1984). In this sensor device, a diaphragm is rigidly connected with a plunger, the displacement of which inside of an inductive measuring transducer generates an output signal. At the same time, the plunger moves inside an electromagnet coil. Supplying the current of a fixed value to the electromagnet coil, it is possible to move the diaphragm simulating a certain increase of pressure, i.e., realizing the test mode. Within the time period of the test mode, the variation of an error value is assumed to be negligible in comparison with the permissible measurement error. If the conversion function "displacement of the diaphragm -pressure" is linear, then the self-check of such a type can detect a metrological fault for a case when the critical error component is multiplicative. The variation of an output signal as a result of the fixed variation of the electromagnet current can be used as the diagnostic parameter. The MDSC of the same type can be realized in a data redundant capacitive sensor device measuring a distance to a flat conducting body. Usually, the critical error component in such a sensor device is caused by fouling of the surface of electrodes. To perform the selfcheck in the continuous mode it is possible to use a two-channel sensor device with the electrodes shifted relative to one another in a direction perpendicular to their surface (Sapozhnikova & Taymanov, 2010a). As the diagnostic parameter, it is possible to use the difference of voltage values at the shifted electrodes at a distance measured with the help of one of them.

Sensor Devices with High Metrological Reliability 13
The MDSC can be organized also on the basis of structural redundancy by combining the sensor under check and additional sensor of different principles of operation in one unit. This method of self-check is applied in an ultrasonic vortex gas flow meter (Hans & Ricken, 2007). A ratio of the value of vortex flow velocity to that of vortex frequency can be used as the diagnostic parameter.
The above examples show that realization of the MDSC on the basis of structural redundancy assumes the combination of the sensor under check and additional sensor into one unit. The main requirement for them and their packaging is reduced to the following. Under the impact of influence quantities generating a critical error component, the variation of conversion functions of the additional sensors should significantly differ from the corresponding variation of the conversion function of the sensor under check.
Realization of the MDSC on the basis of temporal redundancy assumes application of more wideband or fast-response sensors than it is necessary for a non-intelligent analogue. The MDSC of such a type is used in a tachometer sensor device of flow rate. Its critical error component is caused by the wear of a bearing. The growth of the critical error component is accompanied by increase of vibration, which results in increase of the period and amplitude dispersion of the sensor signal. Usually, the variation of the flow rate measured for some revolution periods of a rotating element of the flow meter is distinctly less than the permissible error of measurement. In this case, the period and amplitude dispersion of the sensor signal can be used as the diagnostic parameters. If the critical error component of the temperature sensor device is caused by probable damages of a contact in a network of the sensor device, then the MDSC can be performed by using the temporal redundancy too. To achieve this, speed of a sensor device signal change can be used as the diagnostic parameter. In the process of sensor operation it should be compared with the maximum possible (limited by the equipment time lag) speed of the environmental temperature variation (Taymanov et al., 2010a). The MDSC basing on the functional redundancy implies usage of an additional dependence of a certain output signal parameter on the measurand. This additional conversion function can be revealed in a sensor, introduced artificially or formed using a modulation of a measurand.
The MDSC based on the functional redundancy can be realized in an eddy current sensor device, which determines the distance to a metal non-magnetc target. The critical error component often arises due to a variation of the impedance of the inductance coil parameters in the process of operation, e.g., wind short-circuits or core parameter variation. The critical error component can be evaluated by measuring the active and reactive components of the output signal and comparing their relationship with the reference value obtained at the stage of a previous calibration. The MDSC in a capacitive or eddy current sensor device measuring a distance to the conducting target surface, can also be provided on the basis of functional redundancy by a modulation of the measurand. Such an approach is possible when the surface of the target cyclically moves with regard to the sensor device, e.g., the target is a surface of a rotating shaft. In this case, a step should be cut out on a section of the shaft or a strap has to be fixed there. When the shaft rotates, the distance to the target, which should be measured, is cyclically changing by a known value, e.g., by the value of a step depth. This can be used to estimate metrological serviceability of the sensor device. The examples considered give a general picture of the possibility to organize the metrological diagnostic check.

Metrological diagnostic self-check of pressure sensor device
An analysis has demonstrated that the main sourse of error of the pressure sensor devices with elastic sensors is the residual deformation of sensors (Baksheeva et al., 2010). The method of metrological diagnostic self-check is illustrated below by an example of a sensor device with the Bourdon tube. As it is known, one end of such a tube is rigidly fastened in the device construction and the second end is free. Measuring the displacement of the free end, the pressure supplied to the tube is determined (Andreeva, 1981;Bera et al., 2009;Hashemian, 2005). The main reason of the error of such a sensor is the residual deformation of the tube (Baksheeva et al., 2010). When supplying the pressure, two differently directed deformation processes arise in the tube. The first process is the non-uniform variation of curvature of a tube middle line. The tube does not return into its initial position. Longitudinal fibers undergo some increase of their length. Residual deformation of such a kind results in displacement of ''zero" of the conversion characteristic and increase of the Bourdon tube sensitivity, which in its turn, generates an additive and multiplicative components of error. The second process is the non-uniform variation of transverse cross-sections along the tube. The size of a small semiaxis of the tube cross-sections is increased and consequently, the form of the crosssections approaches to a circle one. The residual deformation of this type results in displacement of ''zero" and decreases the Bourdon tube sensitivity. Thus, both the additive and multiplicative components of error have place here too. The degree of influence of the above processes on the state of the tube depends on distinguished features of a particular tube, as well as on its operating conditions. The multiplicative components of error partly compensate each other, and the additive components of error are summed up. As a result, the additive component of error should be considered to be the critical one. The suggested method of the metrological diagnostic self-checking of an intelligent pressure sensor device on the basis of the Bourdon tube (Baksheeva et al., 2010), is based upon the diagnostic parameter (DP) in the form of a ratio of output signal values determined in various points of the sensor (Fig. 1a). Performed mathematical modelling has enabled the location of additional points of displacement measurement to be optimized. A prototype was made, a displacement signals in which were taken from two points of the Bourdon tube with the help of mechanical transmissions and two differential transformer transducers of displacement. Dependence of relative DP variation on relative error of pressure measurement is shown in Fig. 1b. The diagram indicates that the dependence of the relative variation of the DP on the relative error of pressure measurements is close to a linear one.
The method considered provides the principal possibility for developing an intelligent pressure sensor device with the functions of self-correction and forecast of its metrological state (with gradual accumulation of measurement data).

Metrological diagnostic self-check of temperature sensor device
Sensors of a resistance sensor device measuring a temperature are usually made on the basis of metal wire or thin film. For the temperatures up to 150 o C , they usually apply copper, while for the temperatures to 600 o C, platinum is used. If one sums up the known data (Berry, 1982;Crovini et al., 1992;Hashemian & Petersen, 1992;Li et al., 2010;Mangum, 1984), then within the working temperature range up to T max <(0.25-0.3)T m , where T max is its upper limit and T m is the melting point of platinum, which corresponds to T max (450-500) o C, the main processes affecting the change of the PRT error in its operation can be divided into two main groups. The first group includes the processes leading to destruction of a thin surface layer of conductors and variation of its conductive properties with regard to all sensors of the sensor devices. They are the following: surface oxidation, sublimation of surface substances, contamination of the surface layer by the diffusion of oxides and mixtures from the ceramic fill-up, mechanical damage of the surface, and so on. Under the influence of error sources, which refer to the first group, in the course of time the specific resistance of the surface layer begins to exceed significantly the specific resistance of a conductor material. This can be represented as a certain equivalent decrease of an area of the cross-section of the platinum wire, which correspondingly increases its resistance.
Other processes (which are not connected with the destruction of the surface layer) leading to an unexpected change of resistance of some sensors, in particular caused by consequences of the technological spoilage, refer to the second group. When the processes of the first group dominate, a critical error component is the deviation of the platinum wire resistance, which is caused by variation of the properties of the surface layer.
In (Taymanov et al., 2011) it is proposed to use the structural redundancy for realizing the function of metrological diagnostic self-check, i.e., to make an intelligent sensor device on the basis of two or a number of sensors differently sensitive to factors influencing on the growth of the critical error component. To realize the function of metrological diagnostic self-check in the process of operation, the DP β, that depends on the values of signals coming from various sensors, is calculated, for example, At the stage of the original calibration of the intelligent temperature sensor device, which corresponds to the start of operation, a nominal value 0  of the DP is determined. A relative www.intechopen.com Nuclear Power -Control, Reliability and Human Factors 16 deviation  of the DP from the nominal value is rigidly connected with the error. In the process of operation the check of the metrological serviceability is performed by determining  at a temperature measured and comparing it with a permissible relative deviation.
When the value  exceeds the permissible limit or approaches to such a limit, it is necessary to perform an unscheduled calibration of the sensor device even if the specified interval has not come to its end. When the specified calibration interval comes to the end and  does not exceed a permissible value, then this fact can become an argument for significant increasing the corresponding interval and using the sensor device further.
In the general case (for various designs of the PRT), it is necessary to provide a different ratio of the cross-section area to the perimeter of the cross-section of sensors included into sensor device. In each sensor the destruction rate (rate of resistance variation) of the conductor surface layer, weakly depends on the geometrical parameters of the conductors themselves. The depth of the destructed layer is small as compared to linear dimensions of the conductor cross-section. Then for the simplest version of the sensor device including two sensors 2 0 2 1 00 where a is the assumed thickness of the surface layer subjected to the destruction; 1 P , 2 P and 1 S , 2 S are the perimeters and areas of the cross-sections of the sensors having different sensitivity to factors influencing on the growth of the critical error component, correspondingly.
Provided the relationship between the  value and error T  of the temperature measurement is known, then, using a value of  determined experimentally, it is possible to introduce a corresponding correction into a measurement result. (b) dependence of the relative DP deviation on the relative error of temperature measurements.
For preliminary evaluation of the efficiency of the considered metrological self-check method, there were carried out experimental investigations of the sensor device prototypes. This was done in the mode of a forced load, "heating up to 600°С -cooling", with a cycle time of 70 -80 hours. The prototypes contained two spirals (each having a resistance of 100 Ohm) which were made of a platinum wire of 50 and 30 μm in diameter. In each cycle the resistance of each spiral was measured at temperature of 0 and 450 °С determined with a reference thermometer. Then the values of  ,  , T  and resistance deviation (increment) R for each spiral were calculated (Fig.2). Fig. 2b indicates that the dependence of  on a relative error T  of temperature measurements is close to a linear one. Thus, the method considered provides the principal possibility to develop an intelligent temperature sensor device with the functions of self-correction and forecast of its metrological state.

Combined methods of the metrological self-check. The system intended for measuring control rod position in a nuclear reactor
In Russian-built pressurized water reactor (WWER-1000), a control rod (CR) is moved by a linear stepping electromagnetic drive. A drive rack is connected with the CR. CR position is determined by a special measuring system that consists of a sensor device, a magnetic shunt mounted inside the rack cavity, and electronic processing unit. The CR position sensor device and some drive components (such as the rack and a transfer unit) are located in the coolant. The coolant temperature is up to 325 o C, and its pressure is up to 18 MPa. Also the coolant is under a strong radiation flux. To improve currently used reactors and to build new ones, it is very important to increase sensor device lifetime to about 40-60 years (i.e., to the lifetime of a reactor vessel). In addition, it is necessary to improve the sensor device accuracy and metrological reliability, as well as provide extended diagnostics. All this measures would make nuclear reactor more effective and safe. Under the leadership of the authors, the intelligent system intended for measuring control rod position (IS) with the properties said above was designed and developed . The originality of the applied technical decisions is confirmed by a number of corresponding patents. A developed sensor device of the DPL-KV type is based on eddy current principle. In the sensor device, the combination of structural and functional redundancy is applied, which provides the possibility to perform metrological self-check and self-correction. The sensor device is a data-redundant one and includes 18 inductance coils inside a sealed housing (see Fig. 3a). To provide the required lifetime and metrological reliability, the sensor coils are made of specially designed heat-resistant wire. The wire is based on Ni-Cr alloy covered by nonorganic insulation. The Ni-Cr wire was chosen because of its high stability under temperature variations and long lifetime (according to estimations based on experimental data and calculations, the lifetime of the wire at temperatures about 325 o C is expected to be more than 250 years). All the sensor coils are located much lower than the electromagnets of the drive. This decreases the effect of noise from the electromagnets. The accuracy of CR position measurements was achieved by using multi-component magnetic shunt located inside the rack cavity (Fig. 3a). This shunt consists of a set of bushings made of magnetic and nonmagnetic steel. The coils and the set of bushings form a single-track code chain. The sequence of bushings in this shunt is quasi-random. The total length of the shunt is slightly more than 2 m. For significantly longer shunts, the deeper rack boring is required to give enough space for the bushings. That would increase the risk of rack bending and decrease the rack life. To increase the metrological reliability of the sensor device, the number of coils is redundant. Due to this redundancy, the sensor device keeps working even in case of wrong data (i.e., code bit distortion, which could happen if any signal wire breaks or if any coil fails). As a result, the sensor device has an ability to keep its measuring accuracy within reasonable limits in case of any single failure. That is the sensor device fault-tolerance (recoverability). The electronic processing unit is located in a cabinet outside the containment. It consists of amplifiers, input and output transducers, a digital-analog power supply of the sensor device, and a microcontroller for data acquisition and processing (Sapozhnikova et al, 2005b). All the boards are galvanically isolated from outside devices. The power supply frequency was optimized to maximize signal-to-noise ratio. The microcontroller processes all available sensor device data. Data processing results from all the processing units included in several ISs, are transferred to a higher level controller. Such a design enhances the level of reliability and the effectiveness of control and protection system modernization. As a result, the IS provides:  CR position measurement (accuracy is within 0.3% under all possible conditions);  metrological diagnostic self-check of the reliability of CR position measurements (it is not necessary to calibrate the sensor device in the process of operation);  maintenance of operating integrity if any signal wire breaks or any coil fails;  automatic correction of a sensor device, shunt and processing unit parameters (this eliminates the influence of temperature variations, defects of joints, material and component aging); filtration of various noises;  self-diagnostics of the IS as a whole with failure localization; generation of textual recommendations for malfunction elimination;  assessment of the condition of main drive components (rack teeth, latches of the transfer unit and, partly, electromagnets) according to the step-by-step rack reciprocation diagrams (Fig. 3b); drive condition diagnostics (step missing or delay, as well as teeth slippage); checking of the CR and rack coupling;  sensor device to processing unit connection diagnostics; control connection diagnostics;  measuring and recording of CR drop time diagram (this allows diagnosing the condition of a guide sheath and rack curvature in case of CR emergency shut-down or spontaneous drop); determination of the top and bottom oscillation points during the CR damping process (this allows the condition of a rack damper to be diagnosed); checking whether the CR has fallen down on an arresting device. The metrological and technical diagnostics of the sensor device and microcontroller unit generally consists in comparison between:  the identified code combinations corresponding the CR position and the specified reference code combinations;  the code combinations related to consequent control rod positions and the specified reference code combinations;  the number of real steps made by the CR and the number of corresponding commands;  current sensor coil parameters and their reference values determined at the original calibration.
(a) (b) checking the correctness of the response to an electromagnet current cyclogram,  checking the control rod and rack coupling. The ability to obtain such diagrams is determined by both the high displacement sensitivity of the sensor device and the fact that the time interval between two consecutive control rod www.intechopen.com Nuclear Power -Control, Reliability and Human Factors 20 position measurements is very short. In case of the drive fault, the shape of the diagram is changing. This makes it possible to find out the origin of the fault or to reveal the incipient malfunction (even before appearance of a significant failure). Information about all the CR moves, control commands, operation modes, occurred malfunctions or failures as well as operator's actions are logged in a "black box" recorder. At the same time, the IS estimates the drive operating time by accumulating the parameters like the number of drops, steps made, input control signals, etc. The real time CR position is displayed on a front panel. Each IS can be connected to a local network. With the help of the network, the ISs can perform cross-system diagnostics. This improves the IS fault-tolerance. For instance, the local network gives an opportunity to inform operators about the wrong positions of CR, including the case of CR position mismatch in the control group as well as of any CR slipping down from the end switch. Based on diagnostic information obtained during system operation, an individual "registration certificate" is automatically issued for each drive. This certificate contains an assessment of the drive condition as well as recommendations for operators how to carry out a preventive maintenance. Three ISs operated for many years at the power unit of the Kalinin NPP in Russia and were highly appraised by specialists. For that time interval, the first modification of the processing unit was replaced by a new one. The software parts related to diagnostics were improved. During the operation period, sensor signals varied insignificantly, and a tendency to stabilize the parameters was noticed. During the last years, the average change of resistance of sensor coils was less than 0.2% per year. Extrapolation of the resistance-time function for 60 years shows that the predicted sensor resistance variation is less than 3.5%. With the ability to automatically correct each individual sensor parameter variations within about 25%, the sensor device lifetime is much longer than it is required. The use of the ISs improved the service effectiveness. It was more convenient for the stuff t o w o r k w i t h t e x t u a l r e c o m m e n d a t i o n s f r o m I S i n c a s e o f m a l f u n c t i o n . W h e n t h e emergency shutdown of the power unit happened, the IS diagnostic capabilities helped to localize the failure even outside the ISs. Monitoring abilities are sufficient to extend the equipment lifetime by switching from pre-assigned lifetime to prediction of the state during future fuel cycle. As a result, the power plant can utilize equipment capability to the very end. In particular, the assessment based on the IS "black box" data at the Kalinin NPP gave the basis to increase significantly a projected lifetime of transfer unit and rack. The additional study has shown that the electromagnet temperature can be decreased if a special inexpensive auxiliary component is added to the electromagnet. Altogether, the developed technical solutions enable the lifetime of the equipment to become equal to the lifetime of the reactor vessel. Some additional information with respect to the IS considered has been given in the paper presented at the IAEA meeting (Sapoznikova et al., 2005b). The main ideas used in the IS can be applied to the control and protection systems of other reactor types.

Registration of self-check results. Status of measurement results
An estimate of the measurement error obtained in calibrating a given measuring instrument, cannot be transferred to the measurement results obtained with the help of this instrument significantly later in the process of operation, since the instrument error component changes with time. The metrological self-check results are characterized by some error too. It is not necessarily the case for the error to be determined quantitatively according to the metrological self-check data. For a significant part of applications, the qualitative estimate of the measurement reliability, by giving a certain "measurement value status" to the result of measurement, is expedient. For the first time, this concept was introduced in (Henry & Clarke, 1993). The following gradations of the status are recommended there: secure, clear, blurred, dazzled, blind. In the joint paper of Oxford and St.Petersburg scientists (Sapozhnikova et al., 2005a) a comprehensive reasoning of the necessity to introduce the measurement value status is given and some details of definitions and recommendations are proposed. It is noted that the number of status gradations should depend on the number of human operator's actions required in response to information about the measurement value status. The number of responses is usually no more than 5. The status called "confirmed" indicates that a measurement result has been confirmed by additional information about the metrological serviceability of an intelligent sensor device or intelligent multichannel measuring system, and a risk to use an unreliable measurement result is negligible. This status is desirable in making very important decisions on equipment control. The status "confirmed" can be given to a measurement result obtained from a sensor device or measuring system when information at their output shows that they are in a "healthy" state. The status called "normal" indicates that a risk to use an unreliable measurement result is small, which allows, for example, a decision on equipment control to be made in ordinary situations. This status can be given to the measurement result obtained within the calibration interval from a sensor device or multichannel measuring system, the metrological serviceability of which is not automatically checked in the process of operation. The status called "orienting" indicates that a risk to use an unreliable measurement result increases due to a defect in a sensor device or multichannel measuring system, but the result of measurement can be applied for an orienting estimate of the equipment condition and that of the technological process under control. The "orienting" status is sufficient for making a decision in the case, for example, when parameters of the technological process are far from the borders allowed. Giving the status "orienting" to the measurement result, indicates the need to perform the maintenance of a sensor device or measuring system as well as to set the terms of this maintenance. The status called "extrapolated" indicates that as a result of measurement they use the result obtained by extrapolating the data from the preceding time interval, since received information is unreliable during the known time interval that is rather short. The status "extrapolated" gives grounds, for example, to delay making a very important decision on equipment control before receiving reliable information or to make a certain cautious decision, orienting by a hypothesis that within this known time interval the condition of the equipment and flow of the controlled technological process do not change significantly. The status called "unreliable" indicates that a risk to use an unreliable measurement result is great. The decision should be made to perform the maintenance of a sensor device or measuring system.

www.intechopen.com
Nuclear Power -Control, Reliability and Human Factors 22 Status gradations can be joined into three groups which demonstrate the level of risk:  status "confirmed" or "normal";  status "orienting" or " extrapolated";  status "unreliable". Furthermore, the results of the metrological self-check can include:  an estimate of the error (taking into account a correction when it was made) or critical error component;  time when the corresponding estimate was obtained;  an estimate of a residual metrological life;  history of metrological self-check data.

Conclusion
The technological expansion has led to the situation, when the conventional methods of metrological assurance have ceased to satisfy the high requirements of nuclear power engineering, astronautics and a number of other fields of science and industry for the metrological reliability of measuring instruments. The measurement information validity becomes insufficient. The similarity of the evolution of measuring instruments and biological sensor systems has created a basis for forecasting a significant complication of sensor devices and growth of the need for intelligent sensor devices and intelligent multichannel measuring systems with the metrological self-check. This chapter deals with the general approach to the development of intelligent sensor devices. This approach is illustrated by a number of examples of the measuring instruments including those developed under leadership of the authors, namely, the temperature and pressure sensor devices as well as the intelligent system intended for measuring the position of control rod in a nuclear reactor. It is shown that in the process of operation, the sensor devices with the metrological selfcheck can provide:  practically continuous check of the measurement information reliability;  forecast of the metrological state of a sensor device on the basis of the self-check results obtained in the previous period of time;  automatic correction of the sensor device parameters (in a number of cases). A growth of the need for intelligent and data-redundant sensor devices is confirmed not only by the examples showing that in various countries such devices and corresponding standards and guides (BSI, 2005;GOST R, 1996GOST R, , 2009MI 2021MI , 1989VDI/VDE, 2005) were developed. An increasing number of publications devoted to the topic considered, as well as organization of special sessions at international conferences and preparation of new standards (in particular, e.g., the Russian draft standard "State system for ensuring the uniformity of measurements. Intelligent sensors and intelligent measuring systems. Methods of metrological self-checking"), indicate the growth of this need too. Under the conditions of economics globalization , the enhancement of requirements for the operating safety of various equipment, especially, nuclear reactors, obliges scientists and engineers to develop unified international requirements for standardizing the characteristics of self-checked sensor devices and multichannel measuring systems as well as corresponding terms and definitions with respect to these instruments. To our point of view, the development of intelligent measuring instruments is a natural stage of measurement technique evolution.