Redundancy in Critical Process Monitoring: Why One Sensor Is Never Enough

If you run a single pH sensor on a safety-critical measurement point, you are one failure away from a serious problem. Not a hypothetical problem, but a genuine operational risk that could materialise on any shift, any day. A cracked glass membrane, a depleted reference electrolyte, a cable fault: any of these can take your measurement offline without warning. When that measurement is the only thing standing between a controlled process and a runaway reaction, a failed batch, or an environmental prosecution, "we'll swap the sensor when we notice it's gone wrong" is not a strategy. It is a gamble.

At DP-Flow, we talk to process engineers every week who know they should have redundancy on their critical measurements but have not yet made it happen. The reasons are always practical: cost, complexity, panel space, the belief that redundancy means doubling everything. Modern analytical instrumentation has made true measurement redundancy far more straightforward than most people assume.

What Redundancy Actually Means

Let us be precise about the term, because redundancy in process measurement is often misunderstood. It does not mean keeping a spare sensor in the stores cupboard, or having a technician on call who can swap one within a couple of hours. Those are sensible practices, but they are not redundancy.

True measurement redundancy means two or more independent sensors measuring the same parameter at the same process point, simultaneously, in real time. The transmitter continuously compares the readings from both sensors. When they agree within a defined tolerance, you have confirmation that the measurement is trustworthy. When they diverge beyond a threshold, the system raises an alarm, identifies which sensor is deviating, and automatically continues the measurement using the good sensor.

The critical distinction is continuity. With a single sensor, failure means the measurement drops out and the process runs without feedback until someone intervenes. With redundant sensors, the backup takes over seamlessly: no data gap in your historian, no period of unmonitored operation. The failed sensor is flagged for replacement at a convenient time, not as an emergency.

Where Redundancy Matters Most

Not every measurement point warrants redundant sensors. A pH reading on a cooling water system probably does not justify the additional investment. The case for redundancy becomes compelling when the consequences of a measurement failure are severe, and there are several categories where that is clearly the case.

Safety-critical applications are the most obvious. Chemical neutralisation is a prime example: pH controls the addition of acid or alkali to bring a stream within safe limits. If the pH sensor fails high while the actual pH is dropping, the dosing system responds to a phantom reading and does nothing while the real pH plummets. In the worst case, this triggers a runaway exothermic reaction. Redundant sensors eliminate this single point of failure entirely.

High-value batch processes present a compelling financial argument. In pharmaceutical manufacturing, a single batch of active pharmaceutical ingredient can be worth hundreds of thousands of pounds. If a pH sensor fails during a critical reaction step and the process drifts outside specification, the entire batch may be lost: it cannot be reworked or blended. A second pH sensor costing a few hundred pounds is the most affordable insurance policy you will ever buy.

Environmental compliance is another area where the stakes are high and rising. Effluent discharge consents typically specify tight pH limits, often between 6 and 9. A sensor failure that goes undetected for even a few hours can result in an out-of-consent discharge. The Environment Agency does not accept "the sensor was broken" as a defence. Fines are significant, and in serious cases the consequences extend to prosecution, tightened permit conditions, and reputational damage. Regulators increasingly expect operators to demonstrate reasonable steps to ensure measurement continuity, and documented redundancy is precisely the evidence they want to see.

Continuous processes that cannot be stopped to swap a sensor present a practical problem even where the consequences are less dramatic. If your process runs around the clock, a sensor failure means either running without measurement until the next planned shutdown or performing a hot-swap under process conditions. Redundancy means the failed sensor can be replaced at a convenient time while the backup continues to provide the measurement.

How Knick Makes Redundancy Practical

One of the historical objections to redundant analytical measurement has been infrastructure: if one sensor needs one transmitter, one power supply, and one fieldbus connection, two sensors means doubling all of that. The project gets shelved on cost alone.

The Knick Protos II 4400 changes this calculation entirely. This multi-parameter transmitter accepts up to six Memosens sensors on a single unit. Running two pH sensors on the same measurement point requires one transmitter, one power supply, one fieldbus connection, and one panel slot. The transmitter handles comparison, alarm logic, and failover internally.

In practice, you configure the Protos II with two sensors assigned to the same measurement parameter. The transmitter continuously compares the two readings and displays both values alongside the calculated difference. You set a divergence threshold appropriate to your process: for a neutralisation application that might be 0.2 pH units; for a less critical measurement, 0.5. When the difference exceeds the threshold, the transmitter raises a diagnostic alarm, identifies which sensor has deviated based on the rate and direction of change, and automatically switches the output to the good sensor. Measurement continuity is maintained without operator intervention.

This all happens within a single transmitter. You are not coordinating between two separate instruments with external logic. The redundancy management is built into the device, configured through the standard menu structure, and visible on the local display. The comparison logic runs continuously at the instrument level, not as a periodic check in a higher-level system.

Sensor Health Monitoring: Seeing Failure Before It Happens

Redundancy provides the safety net when a sensor fails, but the ideal scenario is knowing that a sensor is degrading before it actually fails. This is where Memosens 2.0 diagnostics and the Protos II's health monitoring work together.

Every Memosens sensor stores detailed diagnostic data in its onboard memory: glass impedance, reference electrode potential, operating hours, cumulative temperature exposure, and calibration history. These are direct indicators of sensor condition. Rising glass impedance signals membrane ageing; shifting reference potential indicates electrolyte depletion. The trend over time tells you whether the sensor is healthy, approaching end of life, or deteriorating faster than expected.

The Protos II reads this data continuously and presents a clear health indicator for each connected sensor. When you combine this predictive monitoring with a redundant sensor pair, you achieve true zero-downtime measurement. You know sensor A is degrading; you schedule its replacement during a planned maintenance window while sensor B continues to measure. You fit a fresh, pre-calibrated sensor in sensor A's position. The system is back to full redundancy with no interruption and no period of single-sensor vulnerability.

Practical Installation Considerations

Installing redundant sensors is simpler than you might expect, but a few details are worth getting right from the outset.

The physical installation typically uses either a dual-port fitting or two adjacent SensoGate retractable fittings mounted close together on the same pipe section. The SensoGate option is often preferred because retractable fittings allow each sensor to be withdrawn independently under process pressure for cleaning, inspection, or replacement without disturbing the other sensor. This is exactly the kind of practical advantage that makes redundancy viable in continuous operations.

Sensor selection for a redundant pair deserves some thought. Both sensors should be the same type and model, but sourced from different production batches. The reason is common-mode failure: if both sensors come from the same batch and that batch has a subtle defect in the glass composition or reference system, both could fail in the same way at roughly the same time, defeating the purpose of redundancy. Different batches ensure genuine independence between the two measurements.

Pre-calibration is straightforward with Memosens. Both sensors are calibrated on the bench using the same reference buffers, with calibration data stored in each sensor's onboard memory. Once installed, the Protos II reads the stored calibration automatically. There is no field calibration procedure and no risk of errors introduced by working in a difficult process environment.

For ongoing maintenance, Knick's cCare software platform can manage both sensors on an alternating schedule. Sensor A goes to the lab for recalibration while sensor B continues to measure; once A is back, B gets its service. The measurement point is never without at least one recently calibrated sensor, and full redundancy is restored as soon as both are back in position.

The Business Case: Insurance You Can Quantify

Process engineers understand the technical case for redundancy instinctively. The challenge is often making the financial case to justify the investment, particularly when budgets are tight and competing priorities are many.

The arithmetic is straightforward. A Memosens pH sensor costs a few hundred pounds. A pharmaceutical batch lost to an undetected pH excursion can represent a write-off of two hundred thousand pounds or more: the sensor is less than one tenth of one per cent of the value it protects. Even in less extreme applications, the cost of an emergency callout at two in the morning plus the lost production and administrative burden will typically exceed the cost of the redundant sensor many times over.

Environmental incidents carry costs beyond fines. A consent breach triggers an investigation, formal reporting, and potentially prosecution. The Environment Agency publishes enforcement actions, and the reputational impact can be significant. Demonstrating that you had redundant measurement in place and the system managed the sensor failure without a discharge exceedance is exactly the evidence that maintains your standing as a competent operator.

Insurance underwriters and regulators are increasingly sophisticated in their expectations. If you are subject to COMAH regulations, IPC permits, or pharmaceutical GMP requirements, documented redundancy on critical measurement points is becoming a baseline expectation rather than an aspiration.

Getting It Right First Time

At DP-Flow, we have been specifying Knick analytical instrumentation for years, and redundancy is a conversation we have with every customer who operates critical measurement points. We are not interested in selling you equipment you do not need; we are interested in making sure what you install is fit for purpose from day one.

If you are running single sensors on safety-critical, high-value, or compliance-critical measurement points, the conversation about redundancy is worth having sooner rather than later. We can review your installation, advise on where redundancy delivers genuine value, and help you specify a solution that works with your existing infrastructure. Get in touch with us at DP-Flow and let us help you measure twice, so you never have to cut your losses.