400 H

Automation and Drives
Fault-tolerant SIMATIC
SIMATIC S7-400H
The Fault-tolerant Automation System
Benefits
Overview Overview Redundancy features

Avoidance of control system failures due to individual faults
This is attained primarily through a redundant configuration
Switchover Synchronization Self-test Programming CIR Online repair
Fault-tolerance is required in the following cases:

When processing valuable materials When downtimes or production failures would be expensive
When a control system failure would result in high restart costs

In order to enable operation without supervisory or maintenance personnel
Configuration Communication Redundant I/O
A&D AS, 07/2004, Chart 2 Siemens AG 2004 - Subject to change without prior notice
Industries (1)

Power generation and distribution (oil, gas, electricity)

Power plants Pipelines Offshore District heating systems
Chemical, electrochemical, petrochemical and pharmaceutical industries Mining Environmental engineering

Water treatment Refuse incineration
Pulp and paper Steel and metal

Industries (2)

Food and beverages
Glass industry
Semiconductor industry (utilities) Transport
Tunnel automation Marine automation
Airports
Runway lighting Baggage transport
System architecture

Management level
Clients Parallel redundancy Server Parallel redundancy With archive-matching Fault-tolerant communication Media redundancy SW redundancy Warm stand-by Redundant power supply

Ethernet PC network/terminal bus
Process level
H CPUs Hot stand-by
ET 200M
Field level
Redundant IM 153
Redundant PROFIBUS
System integration

Hidden redundancy
Transparent programming (programming same as for nonredundant systems) Standard system parameterization

Standard handling
All SIMATIC programming languages can be used without restriction

Platform for F and FH systems
Redundancy principle (1)

Overview Redundancy features Redundancy features

Redundancy with identical components (homogeneous redundancy)

Majority redundancy
m-v-n
Passive redundancy
1-v-2
Active redundancy
1-v-2
2oo2
2oo2
automatic switchover < 100 ms
Hot stand-by =
Fault-tolerant
m-of-n Fault-tolerant and failsafe

HW or SW voting
automatic switchover in seconds range 1-v-2 2oo2
Redundancy principle S7-400H Warm stand-by = A R

2-v-2 1oo2
Cold stand-by = manual switchover
Failsafe
Redundancy principle (2)


Synchronization, information and status exchange
IM IM DI DO AI AO FM
Process
Bumpless master-stand-by switchover


Switchover time
Switchover time
Switchover Switchover Synchronization Self-test Programming CIR Online repair
< 100ms Outputs are retained during switchover No information or alarm/interrupt is lost
Switchover criteria Master failure

Power supply Rack Sync
Failure of a DP string or DP slave interface module does not force a switchover
module Sync cable CPU
Automatic event synchronization


Synchronization procedure
synchronization
Event synchronization
Time
synchronization
No
Switchover Synchronization Synchronization Self-test
synchronization
Cycle
synchronization
Command
Subcontroller A
Subcontroller A
Subcontroller A
Online repair
Subcontroller B
Subcontroller B
Subcontroller B
CIR
Subcontroller A
Subcontroller B
Programming


Principle
Synchronization, Information and status exchange
Switchover Synchronization Synchronization Self-test Programming CIR Online repair
A S : : : L
I 10.0 O 8.0
Value Ackn.
PW100
A I 10.0 S O 8.0 : : : L PW100 Synchronization L DW 10 + F T PW130 Synchronization
L +
DW 10 F
Switchover
:


Cycle
Switchover Synchronization Synchronization Self-test Programming CIR Online repair Self-test PII
CPU 0 PII exchange
CPU 1 Self-test PII
Synchronization
Configuration User program Communication Redundant I/O Match-up PIO PIO User program


Customer benefits Transparent programming

All
Switchover Synchronization Synchronization Self-test Programming CIR Online repair
standard SIMATIC-S7 programming languages No command restrictions Easy porting of the user program from standard CPU to fault-tolerant CPU
Bumpless switchover
No
loss of information No loss of alarms/interrupts Because all redundancy-specific functions are handled by the operating system, the user can feel assured that he/she has done everything right as far as redundancy is concerned
Comprehensive self-test functions


Self-test
Scope:
CPU Memory
Switchover Synchronization Self-test Self-test Programming CIR Online repair
Synchronization link
Organization:
Startup
self-test in cyclic mode
Complete test
Self-test
Executes permanently as background task Executes in its entirety within a specifiable amount of time (default: 90 minutes)
Online programming

Online modifications same as for standard system

All
modifications are automatically copied to both CPUs
Switchover Synchronization Self-test Programming Programming CIR Online repair
Connecting a PG
At
MPI interface Via bus
Configuration Communication Redundant I/O MPI/DP PROFIBUS/Ethernet
Online programming

Programming/parameter assignment SIMATIC Manager H-station view
Online Programming

Programming Hardware configuration
Configuration in RUN (CIR)


CPU memory configuration
Adding or removing:
Central
Switchover Synchronization Self-test Programming CIR CIR Online repair
I/O or CP DP slaves PA interface and PA slaves Y-link and slaves Modules in modular DP slaves
CPU parameter
Automatic CPU re-incorporation following repair


Connect and update stand-by CPU (1)

MASTER RUN solo Stand-by requests link-up STAND-BY STOP
Switchover Synchronization Self-test Programming CIR Online repair Online repair
Disable Delete, Copy and Generate Blocks Master copies all functions data to stand-by
Execute start routine and self-test
CPU 1 requests update Terminate communication via configured links. Disable low-priority alarms
Master copies dynamic data
User program
OS
Automatic CPU re-incorporation following repair


Connect and update stand-by CPU (2)

MASTER STAND-BY
(link-up)
Disable all alarms/ interrupts

Dynamic data which have changed since the last update Inputs, outputs, timers, counters, memory bits Enable alarms/interrupts and communication Redundant, synchronous operation
Replacing modules in RUN mode


Modules which can be removed and inserted in Run mode

I/O
and CP Sync module Redundant IM 153-2 Redundant power supplies
Redundant components which can be replaced with the power off:

Standard
power supplies Central IM CPU
CPU is automatically updated following replacement (program and data)
Configuration Highlights new CPUs

Overview Redundancy features

Performance Increase
Average
Increase 417-4H appr. x 2,5-3 414-4H appr. x 1,2-2,2 More Memeory 417-4H from 4 MB to 20MB 414-4H from 768KB to 1,4MB
Higher Reliability
Memory
Konfiguration Configuration Communication Redundant I/O
with automatic Ewrror Detection and Correction (EDC) the Controller up to 10km (before 500m)
New Feature
Distance between
Configuration Technical specifications for the CPUs


Two CPU types available

CPU
417-4H with 20MB onboard CPU 414-4H with 1,4MB onboard
General technical specifications, e.g. CPU 417-4 or CPU 414-3 4 integrated interfaces
Two
Configuration Configuration Communication Redundant I/O
for the Sync modules One DP interface One MPI/DP interface
Configuration Redundant link


Replaceable Sync modules Fiber-optics (FO)
Fiber-optics (FO)
Central Controller Configuration


Distance between the Controller up to 10m
Use of the Sync-Modules for Patch Cables up to 10m

MLFB
Module: MLFB FO-Cable 1m: MLFB FO-Cable 2m: MLFB FO-Cable 10m:
6ES7 960-1AA04-0XA0 6ES7 960-1AA04-5AA0 6ES7 960-1AA04-5BA0 6ES7 960-1AA04-5KA0
Distance between the Controller up to 10km Use of the Sync-Modules for Cables up to 10km
MLFB
Konfiguration Configuration Communication Redundant I/O
Module: 6ES7 960-1AB04-0XA0 Monomode FO-Cable LC/LC Duplex crossed 9/125
Central controller configurations


With two standard subracks

Redundant power supply (PS) optional
PS
PS
CPU
PS
PS
CPU
Max. cable length 10km
With H subrack (with split backplane bus)
PS
PS
CPU
PS
PS
CPU
I/O configuration Switched I/O


Redundant IM 153-2
PROFIBUS DP L+ L+ ET 200M with active backplane bus
Configuration Configuration Communication Redundant I/O IM IM
Special bus module (BM) Active backplane bus
I/O configuration Switched I/O: mode of operation


Both DP masters are active and functioning properly

Reading
inputs: The inputs are read only from the preferred channel side (active IM) The data are accepted by both channels. Only the data in the preferred channel are forwarded to the outputs.
Writing outputs:
I/O configuration Connecting PROFIBUS PA via PA link


PROFIBUS DP
2 x IM 157 DP-PA link
I/O configuration Y-Link


Rack 0
Rack 1

IM 153-2 with ET 200M
The Y-link bus coupler creates a network portal from the redundant DP master system to a one-channel DP master system
IM 157 with PA bus
Y-Link with DP bus
I/O configuration Y-Link hardware configuration


IM 157:
6ES7
157-0AA82-0XA0
IM 157
Y-Link
Y-Link:
6ES7
197-1LB00-0XA0
Bus module BM IM 157

6ES7
195-7HD80-0XA0
Bus module BM Y-Link

6ES7
654-7HY00-0XA0
Collective Order No.

6ES7
197-1LA02-0XA0
I/O configuration Y-Link configuration


Redundant communication Principle


Redundant communication is attained through redundant connections, which are then used when a problem occurs.
Redundant connections can be created from H stations to Other H stations (one- or two-channel) HMI PCs (software Redconnect required)
Active connection
Configuration Communication Communication Redundant I/O
Stand-by connection
Redundant communication Configuration with redundant bus (1)


Ethernet
Switchover Synchronization Self-test Programming CIR Online repair H-CPU in single mode
Equivalent circuit diagram:
PS
PS
CPU
CPU
CP
CP
Bus
Bus
CP
CP
CPU
CPU
PS
PS
Redundant communication Configuration with redundant bus (2)


Ethernet
PS PS
CPU CPU
CP CP CP CP
Bus Bus
CP CP CP CP
CPU CPU
PS PS
Redundant communication Configuration with single bus


Ethernet
PS PS
CPU CPU
CP Bus CP
CP CP
CPU CPU
PS PS
Redundant communication Configuration with ring bus


Ring bus
S7-400H
S7-400H
PS PS
CPU CPU
CP CP
Bus Bus
CP CP
CPU CPU
PS PS
Redundant I/O

Switchover Synchronization Self-test Programming CIR Online repair Redundant Profibus

PROFIBUS DP
New: Redundant IO
Redundant Communication
Redundant Controller
Configuration Communication Redundant I/O Redundant I/O
Sensor/control element
Redundant IM
Redundant I/O Possible redundancy structures (1)


Central I/O modules
Distributed I/O modules
Redundant I/O Possible redundancy structures (2)


Distributed switched I/O modules
H-CPU in single mode
Redundant I/O Redundant quality stages


Highest quality level

Use
of F-IO by exploiting the high-quality diagnostic functions required for failsafe operation E.g. when it is necessary to control duration-1 faults associated with output signals
Medium quality level

Use
of modules with diagnostic functions
Low-cost quality level

Use
of modules without diagnostic functions
Redundant I/O Hardware configuration


Slot
DP address
Redundant DI Time discrepancy in ms
Response time following discrepancy Possible options:

AND gate OR gate Use last valid value
Redundant I/O Hardware configuration


Redundancy tab Appears only for redundancy-capable modules. Type of redundancy (none or 2) Station 2, PROFIBUS address 3, slot 4 contains a compatible module. This module is selected as redundant DI
Redundant I/O Wiring digital inputs


With one sensor

DI DI
With two sensors

DI DI
Switchover Synchronization Self-test Programming Redundant Profibus CIR Online repair
DI Master I/O
Both Inputs are read in parallel. The correct value is selected and processed automatically
Redundant I/O DI
Since the function is not suitable for all module types, the manual or Internet should be consulted to find out which modules can currently be used.
Redundant I/O Wiring analog inputs

R
With voltage sensor

AE-U AE-U
With current sensor

AI-I AI-I
With current sensor With 2 sensors

AE-U AE-U
AE AE

U
4-wire transducers only

AI Master I/O
The CPU reads both inputs. The correct value is selected and processed automatically
Redundant I/O AI
Since the function is not suitable for every module type, the manual or Internet should be consulted to find out which modules can currently be used.
Redundant I/O Wiring digital outputs


With diodes *
DQ DQ
Without diodes*
DQ DQ
* Dependant on the module type
DO Master I/O
Both Outputs are set
Actuator
Redundant I/O DO
Since the function is not suitable for every module type, the manual or Internet should be consulted to find out which modules can currently be used.
Redundant I/O Wiring analog outputs


Switchover Synchronization Self-test Programming
Each Output outputs half the value. When one of the modules fails, the output that is still intact provides the full value
AO
Redundant Profibus
CIR Online repair
Master I/O
Both Outputs are set
Actuator
I
Redundant I/O AO
Since the function is not suitable for all module types, the manual or Internet should be consulted to find out which modules can currently be used
Redundant I/O Integrating the user program


The user program is integrated with the "Functional I/O Redundancy" library, which is part of STEP7 V5.3 The redundant I/O are available to the user for programming as transparent I/O
The
rules state that the lowest address must always be used for programming.
Method of operation:
The
inputs are read by FB RED_IN and copied back to the POI following the discrepancy analysis The user writes the outputs to the lowest address in the usual manner. FB RED_OUT automatically copies the relevant value to the second address.

Thank you

400 H

Hochgeladen von

Dokumentinformationen

Originalbeschreibung:

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

400 H

Hochgeladen von

Copyright:

Verfügbare Formate

Automation and Drives

Automation and Drives

Avoidance of control system failures due to individual faults

This is attained primarily through a redundant configuration

Switchover Synchronization Self-test Programming CIR Online repair

Fault-tolerance is required in the following cases:

When a control system failure would result in high restart costs

Configuration Communication Redundant I/O

Automation and Drives

Power generation and distribution (oil, gas, electricity)

Switchover Synchronization Self-test Programming CIR Online repair

Chemical, electrochemical, petrochemical and pharmaceutical industries Mining Environmental engineering

Configuration Communication Redundant I/O

Pulp and paper Steel and metal

Automation and Drives

Food and beverages

Switchover Synchronization Self-test Programming CIR Online repair

Configuration Communication Redundant I/O

Automation and Drives

Switchover Synchronization Self-test Programming CIR Online repair

Configuration Communication Redundant I/O

Automation and Drives

Switchover Synchronization Self-test Programming CIR Online repair

Configuration Communication Redundant I/O

All SIMATIC programming languages can be used without restriction

Automation and Drives

Redundancy principle (1)

Redundancy with identical components (homogeneous redundancy)

Switchover Synchronization Self-test Programming CIR Online repair

automatic switchover < 100 ms

Configuration Communication Redundant I/O

m-of-n Fault-tolerant and failsafe

automatic switchover in seconds range 1-v-2 2oo2

Redundancy principle S7-400H Warm stand-by = A R

Cold stand-by = manual switchover

Automation and Drives

Redundancy principle (2)

Switchover Synchronization Self-test Programming CIR Online repair

Synchronization, information and status exchange

Configuration Communication Redundant I/O

Automation and Drives

Bumpless master-stand-by switchover

Switchover Switchover Synchronization Self-test Programming CIR Online repair

Switchover criteria Master failure

Configuration Communication Redundant I/O

Failure of a DP string or DP slave interface module does not force a switchover

module Sync cable CPU

Automation and Drives

Automatic event synchronization

Switchover Synchronization Synchronization Self-test

Configuration Communication Redundant I/O

Automation and Drives

Automatic event synchronization

Switchover Synchronization Synchronization Self-test Programming CIR Online repair

Configuration Communication Redundant I/O

A I 10.0 S O 8.0 : : : L PW100 Synchronization L DW 10 + F T PW130 Synchronization

Automation and Drives

Automatic event synchronization

CPU 0 PII exchange

CPU 1 Self-test PII

Automation and Drives

Automatic event synchronization