There’s no such thing as a fail-proof thermocouple. Over time, thermocouples fail. To compensate for that, a temperature controller will normally go into upscale burnout mode, and drive the furnace burner to low fire or turn down the SCRs. But then, you have to deal with the downtime, rework, or even the potential of losing product.
Not long ago, a plant operator called to see if there we had a way to work around this burnout mode, so he wasn’t wasting time and materials.
His heat treat load had almost finished its final soak when the control thermocouple broke open. The controller, as expected, drove the furnace burner to low fire. The operator then popped the controller into manual mode, so he could nurse the load through the remainder of its soak cycle. He used the temperature reading on a recorder, fed from a second, unbroken thermocouple in the protection tube as temperature indication for the load.
If the situation had happened in the middle of the night, it may not have been handled with the same attention the day-shift operator had provided.
So, he asked if there was any way to have the controller automatically “fail over” to a second thermocouple.
Systems with built-in redundancy already exist
Multiloop controllers with rack-mount I/O, like Process Automation Controllers (PACs) or higher end PLCs, have multiple I/O points and programming that can implement a control strategy for fail-over to a second thermocouple when the primary control thermocouple breaks.
For some years now, temperature transmitters used in the process industries have had connections and settings for two sensors, so the output would fail over if the primary sensor (or its wiring) failed due to a burn-out (open circuit) condition.
WIKA’s T32 transmitter and Honeywell’s STT350 smart temperature transmitter both have the dual input fail-over feature (sometimes called redundant sensor operation).
But some industries or shops don’t use either multiloop controllers or temperature transmitters. They connect a thermocouple and its extension wire directly to a single loop temperature controller as shown below.
How do stand alone temperature controllers handle thermocouple fail-over?
The Honeywell UDC 3200 or 3500 ¼ DIN controllers do it by alarming on thermocouple break conditions (upscale or downscale) and switching from the primary thermocouple on input #1 to the secondary thermocouple on input #2. It takes about two seconds to switch over, so it’s fast and disrupts the burner very little.
Implementing thermocouple fail-over for UDCs requires the Input #2 and digital input options. Here’s the application note detailing thermocouple fail-over setup for Honeywell UDCs.
The plant agreed with our recommendation to alarm on a failover condition by connecting the controller alarm through an interposing relay to a supervisory system that both annunicates the alarm and sends a text message or email on alarm.
How do PACs or PLCSs handle thermocouple fail-over?
Honeywell’s HC900 hybrid multiloop PAC controller implements thermocouple fail-over by using an analog switch to select either the primary or the secondary thermocouple:
A production schedule need not be disrupted by the failure of a control thermocouple. A low cost, simple thermocouple fail-over strategy can save your day when the primary thermocouple fails by getting the furnace load through its cycle.
Stay tuned for an upcoming blog on automatically detecting potential thermocouple failures.
Lesman Tech Tips 
#1 by Ulaganathan on August 28, 2016 - 1:25 am
Can u please specify reason why incase of Thermocouple failure, control goes to Upscale Burnout mode instead of Downscale? i.e. on What basis Upscale or Downscale is determined?
#2 by danstips on September 6, 2016 - 8:19 am
Burn-out direction is determined by what the desired controller output should be in a fail-safe situation. When a controller can not determine what the Process Variable is due to a failure of some sort, that’s a situation to put the process in a fail-safe condition.
The controller is a thermostat. What does a thermostat do when the reported temperature is far greater than the setpoint?
Does the thermostat call for heat, like the maximum possible output (100%), in order to make the process hotter, when the reported temperature is already hotter than the setpoint?
Or does the thermostat’s output drop to some low value, like 0% to stop any heat input to the system that is already reported to be too hot?
Driving the process variable upscale (when the input fails) makes it appear (for thermal processes) as though the process is too hot, to which the controller responds by driving its output low, to 0%.
#3 by Matt Johnson on October 16, 2014 - 8:12 pm
Great article! Thanks for providing such helpful information. I’m sure that knowing this will help many people, as it will me.