10.2 Simulation, Emulation & Hardware-in-the-Loop (HIL) Verification

Simulation, Emulation & Hardware-in-the-Loop (HIL) Verification

In Domain 4 (Development) of the ISA Certified Automation Professional body of knowledge, verifying control code, safety logic, and supervisory operator interfaces prior to site delivery is essential for risk mitigation. Historically, control systems were commissioned directly on live physical equipment—a practice that led to expensive project schedule slips, physical equipment damage during dry runs, and catastrophic safety hazards during unplanned chemical releases or mechanical collisions.

Modern automation engineering employs simulation and emulation frameworks to validate control software across its full operational envelope. By virtualizing physical process dynamics and testing software against simulated boundary conditions, engineering teams identify logical design errors, tune regulatory loops, and train operations personnel well before physical plant equipment is energized.

---

The Three Levels of Simulation in Industrial Automation

Simulation frameworks are categorized into three hierarchical levels based on mathematical fidelity, engineering effort, and intended verification scope:

HIERARCHY OF INDUSTRIAL SIMULATION:

+-------------------------------------------------------------------------+
| LEVEL 3: HIGH-FIDELITY DIGITAL TWIN                                     |
| - Rigorous 3D spatial geometry & kinematics                             |
| - Multi-component thermodynamic equations of state (Peng-Robinson, etc.)|
| - Real-time IIoT / OPC UA synchronization across full plant lifecycle   |
+-------------------------------------------------------------------------+
                                    ^
                                    |
+-------------------------------------------------------------------------+
| LEVEL 2: FIRST-PRINCIPLES DYNAMIC SIMULATION                            |
| - Mass, momentum, and energy conservation equations                     |
| - Hydraulic pump curves, valve Cv flow, vessel pressure dynamics        |
| - Solves differential algebraic equations (DAEs) in real time           |
+-------------------------------------------------------------------------+
                                    ^
                                    |
+-------------------------------------------------------------------------+
| LEVEL 1: TIE-BACK / LOOPBACK SIMULATION                                 |
| - Digital output tied back to digital input via simple delay timer      |
| - Analog output mirrored to analog input variable                       |
| - Validates discrete interlocks, permissive chains, HMI navigation      |
+-------------------------------------------------------------------------+

Level 1: Tie-Back / Loopback Simulation

Tie-back simulation (also known as I/O loopback) is the simplest and most widely deployed simulation method. It contains no physical modeling of fluid dynamics or chemical reactions. Instead, logic routines inside the controller or staging software simulate field instrument responses through direct boolean and analog linkages:

1. Digital Motor Feedback: When the controller asserts a digital run command (Motor_Run_Cmd = TRUE), an internal on-delay timer runs for 500 ms, after which the simulated motor auxiliary contact (Motor_Run_Aux = TRUE) is asserted. If the run command drops, the auxiliary contact drops immediately.
2. Discrete Valve Feedback: When an open solenoid command (Valve_Open_Cmd = TRUE) is energized, a simulated stroke timer elapses (e.g., 3.0 seconds). Upon timeout, the closed limit switch (Valve_ZSC) drops FALSE and the open limit switch (Valve_ZSO) asserts TRUE.
3. Analog Output-to-Input Mirroring: A $4\text{--}20\text{ mA}$ control valve output (AO_Flow_Valve) is directly scaled and written into the corresponding flow transmitter input tag (AI_Flow_PV), possibly filtered through a simple single-order lag function.

• Engineering Scope & Limitations: Tie-back simulation is exceptionally cost-effective and provides rapid checkout of discrete state machines, start permissives, alarm annunciation, HMI faceplates, and emergency stop interlocks. However, it cannot validate PID loop tuning, multivariable process interactions, hydraulic line pack, or thermal inertia.

Level 2: First-Principles Dynamic Process Simulation

First-principles dynamic simulation utilizes rigorous physics-based mathematical models to represent plant equipment and process media in real time. The simulation engine continuously solves coupled differential and algebraic equations (DAEs) representing:

• Conservation of Mass: $\frac{dM}{dt} = \sum \dot{m}_{in} - \sum \dot{m}_{out}$

• Conservation of Energy: $\frac{dU}{dt} = \sum \dot{m}_{in} h_{in} - \sum \dot{m}_{out} h_{out} + Q - W$

• Hydraulic Flow Through Control Valves: $Q = C_v \cdot f(x) \cdot \sqrt{\frac{\Delta P}{SG}}$, where $f(x)$ is the valve inherent trim characteristic (linear, equal percentage, or quick opening).

• Centrifugal Pump and Compressor Dynamics: Head-capacity curves ($H = a_0 - a_1 Q - a_2 Q^2$) combined with motor torque-speed relationships.

• Thermodynamic Heat Transfer: Jacketed reactor heat exchange using log-mean temperature differences ($Q = U \cdot A \cdot \Delta T_{lm}$).

• Engineering Scope: Level 2 dynamic simulation allows engineers to pre-tune regulatory controllers, test cascade and feedforward architectures, validate compressor anti-surge decoupling algorithms, verify batch reactor recipe execution, and simulate exothermic runaway mitigation.

Level 3: High-Fidelity Digital Twins

A Digital Twin couples Level 2 first-principles physical models with 3D spatial CAD representations, kinematic physics engines, and comprehensive chemical thermodynamic packages (e.g., Peng-Robinson or NRTL equations of state for multi-component hydrocarbon distillation).

Furthermore, a true Digital Twin maintains a continuous, bidirectional communication link with the physical operating asset via IIoT sensors and OPC UA. It runs synchronously with the live plant, providing:

• Real-time parameter estimation and virtual sensor calculation (e.g., unmeasured distillation column tray compositions).
• Predictive condition monitoring and remaining useful life (RUL) estimation for high-value rotating equipment.
• Continuous closed-loop setpoint optimization to maximize thermodynamic efficiency.

---

Software-in-the-Loop (SIL) vs. Hardware-in-the-Loop (HIL)

In simulation, "SIL" means software-in-the-loop; do not confuse it with the Safety Integrity Level used in functional safety.

When executing simulation tests, automation engineers must choose whether to execute the control code in a software-virtualized environment or on target controller silicon.

SOFTWARE-IN-THE-LOOP (SIL) ARCHITECTURE:

+-------------------------------------------------------------------------+
| WORKSTATION / VIRTUAL MACHINE / CLOUD RUNTIME                           |
|                                                                         |
|   +--------------------------+          +---------------------------+   |
|   | VIRTUAL CONTROLLER CORE  |          | SIMULATION PROCESS ENGINE |   |
|   | - Soft PLC / Emulated CPU| <======> | - Tie-Back Logic or       |   |
|   | - Logic Execution Task   |  Shared  |   First-Principles DAEs   |   |
|   | - Virtual Tag Memory     |  Memory  | - Time Warp Acceleration  |   |
|   +--------------------------+          +---------------------------+   |
|                ^                                                        |
|                | Virtual Communication Driver                            |
|                v                                                        |
|   +--------------------------+                                          |
|   | EMULATED HMI / SCADA     |                                          |
|   +--------------------------+                                          |
+-------------------------------------------------------------------------+

---------------------------------------------------------------------------

HARDWARE-IN-THE-LOOP (HIL) ARCHITECTURE:

+---------------------------+                +----------------------------+
| TARGET CONTROL HARDWARE   |                | REAL-TIME SIMULATOR (RTS)  |
|                           |                | (e.g., Opal-RT, Speedgoat) |
|   +-------------------+   |  Deterministic |   +--------------------+   |
|   | Physical CPU Card |   |   Fieldbus or  |   | Hard Real-Time CPU |   |
|   | - Dual Core RTOS  |   |  I/O Interface |   | - Exact Physics DAE|   |
|   | - Prod. Firmware  |===|================|===| - 1 ms Solver Step |   |
|   +-------------------+   |  (EtherNet/IP, |   +--------------------+   |
|             |             |   PROFINET,    |              |             |
|   +-------------------+   |   I/O Racks)   |   +--------------------+   |
|   | Redundant Standby |   |                |   | Physical I/O D/A   |   |
|   | CPU & Sync Link   |   |                |   | & A/D Converters   |   |
|   +-------------------+   |                |   +--------------------+   |
+---------------------------+                +----------------------------+
              ^                                             ^
              | Industrial Ethernet                         | Instructor Link
              v                                             v
   +---------------------+                       +---------------------+
   | PRODUCTION HMI / OS |                       | INSTRUCTOR STATION  |
   +---------------------+                       +---------------------+

---

Operator Training Simulators (OTS) per ANSI/ISA-77.20

The standard ANSI/ISA-77.20 (Fossil-Fuel Power Plant Simulators - Functional Requirements) and related process industry guidelines establish functional criteria for high-fidelity Operator Training Simulators (OTS). An OTS pairs a Level 2 or Level 3 dynamic process model with either an emulated or stimulated control system to replicate control room operations.

Simulator Topologies: Stimulated vs. Emulated OTS

• Stimulated OTS: The actual production HMI software and physical controllers (or exact virtual controller binaries) are connected to the dynamic process simulation engine. Operator screens, alarm banners, trends, and faceplates are bit-for-bit identical to the operating plant.
• Emulated OTS: The operator interface and control logic are translated and approximated within a third-party simulation package. While cheaper, emulation often introduces subtle discrepancies in PID execution algorithms, alarm handling, and graphic behaviors.

Mandatory Instructor Station Capabilities

ANSI/ISA-77.20 specifies instructor functions for power-plant simulators, and industrial OTS generally follow the same model: an autonomous Instructor Station grants the trainer comprehensive authority over the simulation session without interfering with the trainee's control interface:

1. Run / Freeze (Pause): The capability to instantly freeze the simulation across all differential solvers, timers, and controller scans. While frozen, process variables remain static, allowing the instructor to explain transient phenomena, review trend graphs, and assess operator actions before resuming.
2. Initial Conditions (IC) / Snapshot Management: The capability to capture the complete memory state of the plant and control system at a specific operational operating point (e.g., IC 10: Cold Plant Startup; IC 20: 50% Baseload; IC 30: 100% Maximum Continuous Rating). Instructors can instantaneously reset the simulator to any pre-saved IC to repeat training drills.
3. Backtrack / Replay: The simulation engine continuously logs dynamic plant states into circular historical memory buffers. If an operator makes an operational error, the instructor can backtrack the simulator 5, 10, or 30 minutes in time, allowing the operator to observe the error and attempt the recovery sequence again.
4. Malfunction and Fault Injection: The instructor can inject hundreds of deterministic equipment and instrument malfunctions in real time or via automated scenario scripts, including:
   • Transmitter Failures: Drift, freeze on last value, fail full-scale high ($20\text{ mA}$), fail downscale low ($4\text{ mA}$), or inject high-frequency noise.
   • Control Valve Failures: Actuator diaphragm rupture (fail to spring state), stem packing stiction, mechanical freeze in current position, loss of instrument air supply.
   • Rotating Machinery Trips: Electric motor winding overload, pump cavitation, mechanical seal failure, bearing vibration trip.
   • Process Fouling & Leaks: Heat exchanger tube rupture, catalytic reactor fouling, line blockage, pipeline vapor lock.

---

Validating Sequences, Interlocks, and Emergency Response

A primary justification for high-fidelity simulation and HIL testing is the ability to validate hazardous, safety-critical, and abnormal operating scenarios that can never be intentionally induced on a physical, operating plant.

ABNORMAL SITUATION VERIFICATION MATRIX:

+-----------------------------+-----------------------------------+-----------------------------------+
| HAZARDOUS OPERATIONAL EVENT | PHYSICAL PLANT RISK IF TESTED     | SIMULATION / HIL VALIDATION SCOPE |
+-----------------------------+-----------------------------------+-----------------------------------+
| Complete Instrument Air Loss| Simultaneous unseating of fail-   | Verifies fail-safe spring stroke  |
| (Header Depressurization)   | open valves; unit-wide trips.     | of all valves; checks alarm order.|
+-----------------------------+-----------------------------------+-----------------------------------+
| Reactor Thermal Runaway     | Vessel overpressure, relief disc  | Tests quenching sequence, dump    |
| (Exothermic Reaction Exceed)| bursting, environmental release.  | valve timing, and SIS interlocks. |
+-----------------------------+-----------------------------------+-----------------------------------+
| Gas Compressor Surge Cycle  | Catastrophic shaft vibration,     | Validates anti-surge valve opening|
| (Rapid Discharge Inflow Cut)| impeller blade destruction.       | speed and fast-recycle response.  |
+-----------------------------+-----------------------------------+-----------------------------------+
| Dual Utility Power Dip      | Uncontrolled motor dropouts,      | Tests bumpless UPS transfer, ride-|
| (Brownout / Phase Loss)     | brownout damage, arc flash hazard.| through, and re-acceleration logic|
+-----------------------------+-----------------------------------+-----------------------------------+

Validation of ISA-88 Batch State Sequences

In batch chemical and pharmaceutical operations governed by ISA-88, procedural state logic consists of complex state transitions: Idle $\rightarrow$ Running $\rightarrow$ Holding $\rightarrow$ Held $\rightarrow$ Restarting $\rightarrow$ Aborting $\rightarrow$ Aborted.

Testing these transitions on a live bioreactor filled with thousands of dollars of sterile growth medium is unthinkable. In a dynamic simulation environment, engineers deliberately trigger emergency aborts, fail utility feeds, and inject operator holds at every step in the recipe. The simulation verifies that:

• Interlock boundaries prevent hazardous valve lineups during phase aborts.
• Vessel jackets automatically transition from heating to cooling without thermal shock.
• Dose totalizers freeze accurately during hold states and resume without double-dosing raw ingredients upon restart.

---

Realistic Industrial Scenario: Gas Compressor Anti-Surge HIL Testing

An engineering firm is delivering a dual-train centrifugal compressor package for an offshore natural gas production platform. Compressor surge—a rapid, violent reversal of aerodynamic flow across the impeller—can shatter compressor bearings and destroy the machine within several hundred milliseconds.

To validate the anti-surge control software without endangering the multi-million dollar compressor:

1. Test Architecture: The team sets up an HIL test facility. The actual production triple-modular redundant (TMR) safety and control processors are mounted in a test rack and connected via redundant EtherNet/IP links to a hard real-time dynamic simulator running at a $1\text{ ms}$ solver cycle time.
2. Dynamic Physics Model: The simulator models the compressor stage maps, gas composition, suction/discharge pressures, and the non-linear aerodynamic characteristics of the gas.
3. Abnormal Scenario Injection: During the simulation, the test engineer suddenly trips the downstream discharge block valve, creating a massive pressure spike that drives the operating point toward the surge limit line at a rate of $150\%\text{ per second}$.
4. Verification Results: The HIL test reveals that while the anti-surge algorithm calculated the correct surge margin, the analog output task priority was set too low in the controller RTOS, delaying the surge valve fire command by 65 ms. This latency allowed the operating point to cross the surge limit line in the simulation.
5. Remediation: The engineering team increases the priority of the anti-surge periodic execution task from Priority 10 to Priority 2 and re-tests. Under the reconfigured task schedule, the anti-surge valve fires within 12 ms, cleanly averting the surge cycle. The flaw was resolved in the test laboratory at minimal cost, avoiding catastrophic compressor destruction during field startup.

---

Common Exam Traps

1. Assuming Tie-Back Simulation Validates Regulatory Loop Tuning: Exam items frequently ask whether a Level 1 tie-back simulation can be used to tune PID loops. Remember: Tie-back simulation uses artificial delays and static ramps that bear no relation to physical heat transfer, fluid inertia, or hydraulic resistance. Loop tuning can only be validated using Level 2 first-principles dynamic simulation or live plant data.
2. Confusing Software-in-the-Loop (SIL) with Hardware-in-the-Loop (HIL): SIL executes controller code entirely within a PC/server virtual runtime environment (soft PLC). HIL requires the actual physical controller hardware (CPUs, communication adapters, and power chassis) interfaced to a real-time simulator. SIL cannot validate controller processor silicon loading, backplane bus latencies, or physical redundancy switchover mechanics.
3. Overlooking ANSI/ISA-77.20 Instructor Station Capabilities: Questions on Operator Training Simulators often focus on the four mandatory capabilities of an instructor station: Run/Freeze, Initial Condition (IC) snapshots, Backtrack/Playback, and Malfunction/Fault injection. Be prepared to identify these functions and distinguish them from standard operator control tasks.