2. Correlation fundamentals

In a safety-relevant response pipeline, "correlation" is not a single operation but a contract between two or more signals that must agree before a protective action is permitted. That contract has three dimensions: when the signals are compared (the correlation window), where in the parameter space they must agree (the corridor geometry), and how the signals are brought into a common time base (temporal alignment). A two-out-of-two (2oo2) or two-out-of-three (2oo3) voting scheme is only as trustworthy as these three dimensions. If the window is too wide, a stale sample can masquerade as a concurrent one; if the corridor is too narrow, healthy signals trip on noise; if alignment is wrong, correlated signals appear to disagree and the safety function either fails to act or acts spuriously.

Correlation windows: bounding the comparison in time

A correlation window defines the maximum admissible time separation between two events that are still considered "the same event." It is expressed as a half-width ±Δt around a reference timestamp, or as a sliding interval [t − Δt, t] when the reference is the most recent sample. The choice of Δt is a trade-off between coverage (catching genuine concurrent faults) and discrimination (rejecting unrelated transients).

A practical starting point is to derive Δt from the pipeline's own timing budget rather than picking a round number. Suppose a pressure transmitter has a 20 ms sampling period, the fieldbus adds up to 8 ms of jitter, and the safety controller scans every 10 ms. The worst-case skew between two redundant channels is then roughly 20 + 8 + 10 = 38 ms. A window of ±50 ms covers that skew with margin while still being far shorter than the physical process time constant (for a gas header, often 0.5–2 s), so a genuine overpressure ramp cannot slip between the two channels unnoticed.

# Example: window sizing from the timing budget (illustrative values)
sample_period_ms   = 20
bus_jitter_ms      = 8
controller_scan_ms = 10
worst_case_skew_ms = sample_period_ms + bus_jitter_ms + controller_scan_ms   # 38
correlation_window_ms = 50   # >= worst_case_skew, << process time constant

Two failure modes are worth naming explicitly. A window that is too tight produces false disagreement: the channels are healthy but their samples land on opposite sides of the boundary, so the vote degrades and the safety function may trip spuriously. A window that is too loose produces false agreement: a channel that has already failed can still be paired with a fresh sample from a healthy channel, masking the fault. The window should therefore be documented as a derived parameter, not a magic constant, and re-derived whenever sampling, bus, or scan timing changes.

Corridor geometry: bounding the comparison in value

Where the window bounds time, the corridor bounds value. Plot channel A against channel B and the admissible agreement region is a band around the identity line B = A. In its simplest form the corridor is a symmetric tolerance |A − B| ≤ ε, which is a strip of constant width. In practice, two refinements matter.

First, real sensors have gain and offset error, so a constant-width strip is often wrong at the extremes of the range. A more faithful corridor is an affine band: |B − (k·A + c)| ≤ ε, where k captures span mismatch and c captures zero offset. Second, many processes are rate-limited, so the corridor should be widened during fast transients and narrowed during steady state. A common implementation is a dynamic corridor whose half-width grows with the observed rate of change:

# Dynamic corridor half-width (illustrative)
epsilon_base   = 0.5      # kPa, steady-state tolerance
rate_gain      = 0.02     # kPa per (kPa/s) of observed rate
rate_A         = abs(dA_dt)
epsilon_dyn    = epsilon_base + rate_gain * rate_A
correlated     = abs(B - (k*A + c)) <= epsilon_dyn

The corridor is the geometric expression of "how much disagreement is still physically plausible." It should be justified from sensor accuracy (e.g., ±0.25% of span), installation effects, and expected process dynamics — not from a desire to make the vote pass. When a corridor is widened to silence nuisance trips, the underlying cause is usually a mis-sized window or an alignment error, and widening the corridor merely hides it.

Temporal alignment: putting signals on a common time base

Correlation is meaningless until the signals share a time base. Three alignment errors dominate field problems. Clock offset shifts one channel's timestamps relative to the other; transport latency delays a channel by a fixed or variable amount; and sample-and-hold skew means the two channels were physically sampled at different instants even if their timestamps agree. The first two can be corrected by timestamping at the source and applying a measured offset; the third cannot be corrected after the fact and must be bounded by the window.

A robust pipeline therefore does three things in order: (1) timestamp every sample at the sensor or at the first intelligent node, never at the controller; (2) estimate and compensate the fixed transport offset per channel, for example by cross-correlating a known step response during commissioning; and (3) compare only samples whose corrected timestamps fall inside the window. The following sequence illustrates the order of operations for a single evaluation cycle.

Note the ordering in the figure: alignment precedes windowing, and windowing precedes the corridor test. Reversing the order — testing the corridor on unaligned samples — is a common commissioning error that produces intermittent, hard-to-reproduce disagreements. The rejection path is equally important: when no pair falls inside the window, the pipeline must declare disagreement and hold or degrade the vote, rather than silently reusing the last valid pair.

Putting the three dimensions together

The three dimensions are coupled, and tuning one in isolation usually moves the problem elsewhere. A useful discipline is to treat them as a single derived specification per safety function:

During commissioning, verify each dimension with a deliberate stimulus rather than trusting the configuration. Inject a step on channel A only and confirm that the pipeline reports disagreement within one window; inject the same step on both channels with a known delay and confirm that the offset compensation restores agreement; then sweep the amplitude until the corridor boundary is crossed and record the trip point. These three checks confirm that the window, corridor, and alignment are each doing their job, and they leave behind a documented basis for the parameters — which is exactly what a safety case needs when the timing budget or the sensor population later changes.