A plausible temperature can remain unchanged after acquisition stops. Retain acquisition time separately from packet receipt and verify clock quality; NIST OT guidance explains why timestamp accuracy is essential to event interpretation [1].
Detect loss of confidence before replacing the value
Retain separate timestamps for acquisition and receipt. A newly received packet can contain an old measurement. Compare the reported temperature trend with known load changes and any independent thermal observations, but do not classify every slow temperature response as a failed sensor; the transformer itself has thermal inertia.
Define the detection criteria using the installed sensor, sampling arrangement and communication system. A fixed universal timeout would ignore those differences. The criteria should expose when the measurement becomes unsuitable for the intended control decision, not merely when a communications alarm is raised.
| Control state | Information used | Transition condition |
|---|---|---|
| Normal estimation | Credible temperatures plus current and ambient history | Measurements pass freshness and consistency checks |
| Uncertain sensing | Last credible state advanced with bounded inputs | Temperature confidence is lost |
| Conservative operation | Approved fallback limits and available electrical observations | Uncertainty exceeds the usable thermal margin |
| Recovery evaluation | Restored measurements compared with the advanced estimate | Sensor data is stable and the discrepancy is understood |
Advance the uncertain state through the missing interval
Advance the last credible state using current history, ambient and cooling inputs in a heat-storage model [2]. Carry uncertain initial state/parameters into an interval. If another required input is missing, widen that interval or use the approved fallback rather than retaining false precision.
For a proposed schedule, evaluate the credible upper thermal condition. The available charging allowance may shrink as the period without reliable sensing grows. That is a consequence of losing information, even if the last measured temperature was modest. Local protection and equipment limits remain independent of the scheduling service.
Restored communication does not mean restored confidence
A recovered sensor may report a value far from the propagated estimate. Investigate whether that difference comes from the sensor, a time offset, a missing cooling change or the thermal model. An immediate return to the full allowance can combine a measurement discontinuity with a synchronized charging restart.
Assume an independent fallback exercise bounds winding hot spot at 90–105 °C after sensor failure. A proposed block adds an assumed 8 K in adverse cooling, against an assumed project ceiling 110 °C. The upper prediction is 113 °C, failing by 3 K even if a central estimate passes. Reject or reduce the block and qualify the real bound before deployment; the fictional interval is not evidence that this sensor/model has been validated.
Use a documented recovery transition that respects the verified state and outstanding charging demands. Log the last credible observation, the uncertain interval, the fallback decisions and the evidence used to resume normal control. The event record should make it possible to assess the decision later without inventing temperature measurements for the missing period.
References
- K. Stouffer et al., NIST SP 800-82 Revision 3, Guide to Operational Technology (OT) Security, September 2023, sections 3.1 and 6.2.12. DOI: 10.6028/NIST.SP.800-82r3.
- U.S. Department of Energy, DOE-HDBK-1012/2-92, Thermodynamics, Heat Transfer, and Fluid Flow, Volume 2, 1992.