Heater Sensor Faults: An Open RTD Must Not Look Like a Cold Load

System boundary

A thick-film heater, an installed resistive temperature sensor, its leads, excitation, acquisition electronics, temperature conversion and heater-permission logic. The independent protective path remains a separately reviewed system function.

Integration interfaces

Integration risks

Start from the circuit, not from an assumed open-circuit temperature

Identify the sensor's two electrical ends and every lead connected to them. Draw excitation, reference generation, bias paths, input protection and filtering. A current-excited converter, a voltage divider and a bridge need not produce the same code when a lead opens. Even within one arrangement, opening a force lead and opening a sense lead can have different effects.

Treat fault signatures as properties of the complete connection and diagnostic state. A generic statement that an open RTD reads hot or cold is insufficient. The released review should identify each accessible failure location and the corresponding raw voltage, conversion status and required permission response.

Show why wiring orientation reverses an open-fault indication

Consider an independent simple divider example, not a recommended heater safety circuit. A fixed resistor connects to a 3.3 V source and an RTD connects from the measured node to return. With both resistances assumed to be 100 Ω, the node is 1.65 V. An ideal open RTD pulls that node toward 3.3 V; an ideal short pulls it toward zero.

If the RTD and fixed resistor exchange positions, the same open RTD instead leaves the node near zero through the fixed resistor. Thus the direction of the code change cannot be inferred from the sensing material alone. Input bias, protection and broken supply or return paths can produce additional states beyond these ideal examples.

Do not classify a full-scale code without checking the reference

In some ratiometric connections, the same excitation path develops both the sensor voltage and the converter reference. A broken path can therefore invalidate the reference as well as the intended input. A saturated or unstable output then does not represent a measured high resistance and must not be passed through an ordinary resistance-temperature equation.

Use the exact converter's diagnostic capabilities and documented restrictions. Diagnostic currents can change the input voltage and may need their own measurement state rather than being left active during precision acquisition. The method must account for input-filter resistance and settling, because a shorted sensor need not produce an exactly zero diagnostic code.

Link raw observations to permission, not to guessed temperatures

Populate the table using the actual circuit and approved fault-injection method. The response is intentionally expressed as invalid input or a separate physical concern, rather than an invented temperature at the electrical limit.

Check validity before conversion and demand calculation

A robust processing order distinguishes acquisition completion, electrical validity, physical plausibility and use by the controller. The specific implementation belongs to the controls owner, but a fault must not become a valid cold value merely because a conversion function clamps an input to its minimum table entry.

Inspect integer conversion, signed overflow, missing-value substitutes and fallback behavior. Reusing the last valid temperature after a new fault can conceal a rapidly changing heater. If a bounded holdover is part of the approved design, its duration and protective context require explicit validation; it is not an automatic consequence of having one older plausible measurement.

Inject electrical faults with the heater energy safely controlled

Begin with the power stage unable to energize the heater through the defined test arrangement. Use a suitable controlled resistance substitute or fault fixture to verify the readout and command behavior. Open individual leads and apply only the approved short or boundary conditions; arbitrary live probing can damage electronics or create a hazardous state.

Record raw codes, diagnostic configuration, reference observations, interpreted validity, requested power and actual output state. Then complete the appropriate system-level validation under the qualified safety plan. A software flag changing correctly in a bench simulation does not prove that the real interruption hardware removes energy within its allocated time.

Keep thermal detachment outside electrical continuity coverage

An RTD lifted from a heater can remain within its normal electrical range while tracking cooler enclosure air or a cable support. An open-wire detector will not necessarily detect that failure, because there is no open wire. Do not broaden the claimed coverage of the electrical fault table to include thermal attachment loss.

Review retained position, attachment integrity and the independent protective sensing path. A controlled installation study can examine how the sensor response changes after a defined mechanical disturbance, but thresholds and fault exposures require application-specific approval. The sensor's plausible number remains a temperature at its own location, not proof of the heater's hottest region.

Verify fault clearing and restored measurement separately

After restoring an electrical connection, allow the documented readout configuration and filters to settle and re-establish valid observations. Whether heating can resume immediately, requires reset or requires inspection depends on the approved fault policy. Do not let a transient good code silently clear an intervention-required fault.

Retain the circuit revision, input configuration, injected locations and measured response for each case. Repeat affected checks after changes to sensor wiring, filters, reference topology, converter firmware or conversion tables. The deliverable is explicit electrical fault coverage and its control consequence, with attachment failures and independent protection identified as separate responsibilities.