1. Cost-effective Unity Premium Hot Standby Solution
Presenter – Tom Royal
Americas Business Support
End User Domain – Automation BU
Call-in number
Passcode

2. Contents Overview Typical architectures Competition
Sales Arguments and Value Proposition
Migration from Standalone
Targeted applications and opportunities
Operation and Rollover
Positioning with Quantum

3. Introduction What is HSBY?
Automation system keeps running despite a controller failure
Primary PLC with a Standby PLC as backup
Running guaranteed only for the first failure
No guarantee for a second failure in the system (unless the first one is repaired)

4. Introduction HSBY overview
The UNITY Premium Hot Standby System is designed for use where downtime cannot be tolerated.
Two backplanes are configured with identical hardware, firmware** and application program.
One of the PLCs acts as the Primary. The Primary Controller updates the Standby Controller at the beginning of each scan.
Primary and Standby States are switchable. Either controller can be put in the primary state.
The remote I/O (STB,OTB… ) is never aware of the existence of two PLCs.
The CPU-sync link is a point-to-point connection dedicated to application data exchange and hot standby system diagnostics.

5. Typical Architecture with Redundant I/O & SCADA Network
Primary Premium
ETG1000
ATV61
Ethernet TCP/IP network #1
STB
ETY
Modbus
Tesys U
CPU-sync Link
Ethernet I/O Scanner RING
VIJEO CITECT
OTB
ETY
XBT-GT
Ethernet TCP/IP network #2
Momentum IO
Standby Premium

6. Value Propositions Easy to program and operate
Design and commission as quickly as a standalone application
No specific user programming.
Access to all Unity Pro and IEC features
Easy to Operate
Hot Swap and auto-reconfiguration ability for selected I/O modules
Bumpless rollover for selected I/O modules
Transparent rollover for SCADA & HMI (IP swapping)
Efficient
Uses our experience in HSBY systems
Efficient data context exchange (no application programming)
Uses the very powerful Unity Premium hardware
Execution performances

7. Typical Premium HSBY Architecture STB I/O islands over Ethernet
Briefly:
Specific Hot Standby CPUs required.
Hardware redundancy – not software.
CPUs are linked with Ethernet crossover cable.
I/O located remotely through Ethernet
network (ring topology).
Local rack I/O can also be used (redundant)
SCADA
Premium PRIMARY
Premium STANDBY
Ethernet I/O ring 10/100 Mbps
Modicon M340
Advantys STB
Momentum

8. Typical Rockwell ControlLogix Architecture Flex I/O islands over ControlNet
Briefly :
Hardware redundancy with a dedicated
redundancy module
Dual attachment topology

9. Typical Siemens architecture ET200 I/O islands over Profibus
Briefly :
Software redundancy solution
Dual attachment topology

10. Typical Siemens S7 400H architecture ET200 I/O islands over Profibus
Briefly :
Hardware redundancy solution
Dual attachment topology
Rack 0
Rack 1
IM with ET200M
IM 157 with PA bus
Y-Link with DP bus

11. Market segmentation Performance
Hardware
Redundancy
Fast S/O
on CPU &
Rack I/O
Fast S/O on
Remote I/O
Siemens S7400H
Quantum Hot Standby
AB ControlLogix
Slow S/O on
Remote I/O
Omron CS1D
ETY
Premium Hot Standby
Software
redundancy
Slow S/O
on CPU &
Rack I/O
SiemensSoftRed
Premium WSBY
Slow
Fast except Small App
Fast
Very Fast
SCAN
Time

12. Pricing policy Comparison of: Premium HSBY with STB I/O over Ethernet
Siemens SoftRed with ET200 I/O over Profibus
Siemens S7400H with ET200 I/O over Profibus
Rockwell Contrologix with Flex I/O over ControlNet

13. Sales arguments Strong points of the offer:
High Performance in terms of scan time, CPU & rack I/O performance while keeping “bumpless” warranty (Rockwell / Siemens SoftRed)
Just enough global functionalities for targeted markets (SI)
Flexibility in terms of rollover performances and availability rate
Non-specific HSBY programming (SI – Siemens SoftRed)
IP address swapping and Ethernet choice (SI - Everybody)
Long lasting investment (EU)
Ring topology gives higher redundancy (better than Siemens/Rockwell).

14. Sales arguments Weak points of the offer (and how to address them):
Fieldbus compatibility with instrumentation (SI). Go through gateways, push architectures with Ethernet compatible devices, move to Quantum
Process stopped while doing heavy process modifications (EU). Address applications where process can be stopped sometimes or where application updates are not requested
No Remote I/O double attachment. Propose in-rack I/O - put I/O island in a cabinet with switch or use remote M340 or move to Q HSBY
No Power Supply redundancy. Duplicate the STB islands or move to Q.
No Automatic Download from Primary to Standby (EU)

15. Worldwide Sales Figures
Global sales
~100 unit - equally split between the two part numbers.
No quality issues so far!
By market segment

16. Targeted Applications
Fault Tolerant Solution for Non Time-critical Applications where:
Production downtime is expensive
Valuable material is processed
Production restart costs are high
Skilled monitoring, maintenance personnel are rare
Infrastructure
Power
Tunnel
Airport
Water

17. Targeted Application Examples
Water
Water treatment
Desalination
Power production
Hydroelectric dams
Road infrastructure
Tunnel Lighting, Ventilation and Signaling
Road Signaling
River infrastructure
Locks
Airport infrastructure
Runway lighting and signaling

18. HSBY Operation and Rollover Premium Hot Standby System Overview
CPU SYNC
ETY SYNC ( Monitored )
It is not possible to have non-ambiguous diagnostics of the Premium Hot Standby system with only one link between the two PLCs (CPU-sync link). Therefore an Ethernet module in each PLC is configured, then they’re linked with an Ethernet cable (with or without switches).

19. HSBY Operation and Rollover Interpreting LED blink patterns
Display Block Indicators:
ERR: faults relating to the Processor Module
RUN: Program Execution States and Hot Standby Mode
I/O: faults on another Station Module or Configuration fault
TER: activity on the Terminal port
ACT: Blinking: indicates communication between Primary and Standby Controllers
STS: Blinking: the System is Redundant and Data are exchanged from Primary to Standby Steady On: the System is not Redundant or Copro is booting from Power-on to end of self-tests Steady Off: Copro Auto Tests Failed
State of RUN LED depends on the HSBY Mode:
PRIMARY
STANDBY
OFFLINE
STOP

20. HSBY Operation and Rollover System Words & Bits
In accordance with IEC Standards, Unity uses global objects called System Bits and System Words:
System Words:
%SW60 - Read / Write the Premium Hot Standby Command Register.
%SW61 – Read the Premium Hot Standby Status Register.
%SW62/63/64/65 - Reverse Registers reserved by the Reverse Transfer process Written by the Application program Controlled and transferred at each scan to the Primary controller.
%MW0 to %MW99 – Non-Transfer Area

21. HSBY Operation and Rollover Database Transfer Diagram
The Database is built automatically by the Primary PLC Operating System and sent
at each Primary PLC cycle to the Standby PLC. This exchange is performed via the
embedded Ethernet coprocessor of the two HSBY PLCs.
Database
Primary
Redundant
Reverse registers
Located Variables (maximum 128 kilobytes)
All Unlocated variables up to 300 kb (depending on the CPU** )
**CPU
Max data size
TSX H57 24 M
193 kbytes
TSX H57 44 M
440 kbytes

22. HSBY Operation and Rollover Database Transfer Timing - 1
At the start of each scan cycle, the contents of the data memory in the “Primary” PLC are transferred to the “Standby” PLC.
1 – Time required to copy the application data to the communication link layer.
2 – The Hot Standby system is thus able to transfer a data zone from the “Primary” PLC to the “Standby” PLC
The Standby PLC refreshes its own OUTPUTs managed in the first section

23. HSBY Operation and Rollover Database Transfer Timing - 2
No impact on the PRIMARY cycle time
We use a CYCLIC or a PERIODIC mode and the time to transfer the data is less than the scan time of the PRIMARY.
INPUT
HSBY Copro
Program
OUTPUT
OUTPUT
INPUT
WAIT +
HSBY Copro
Data exchange
1 section
OUTPUT
INPUT
WAIT +
HSBY Copro
Data exchange

24. HSBY Operation and Rollover Database Transfer Timing - 3
PRIMARY cycle time is affected
We use a CYCLIC or a PERIODIC mode and the time to transfer the data is greater than the scan time of the PRIMARY.
INPUT
INPUT
HSBY Copro
Effect: Output flickers on in-rack I/O (not I/O Scanning) because the outputs are managed in parallel
WAIT +
HSBY Copro
Program
Data exchange
OUTPUT
1 section
INPUT
OUTPUT
HSBY Copro
+ WAIT
INPUT
Data exchange
WAIT +
HSBY Copro

25. HSBY Operation and Rollover X-Bus (local) I/O Rollover Time
The rollover time is the time between the last update of an output by the old Primary and the first update of that same output by the new Primary. **
** Worst case for the rollover performance

26. Unity Pro Configuration Information Tab
In this screen Hot Standby status is clearly displayed.

27. Unity Pro Configuration Hot Standby Tab
“Topological address (slot #) of the monitored Ethernet module”:
This dropdown is populated by the addresses of the existing ETY modules.

28. HSBY Operation and Rollover Selection of Primary PLC
A & B designations:
PLC with lowest MAC address in Ethernet copro becomes “A”
MAC1 = F4.01.6E.E MAC2 = B4.01.6E.E1
Which becomes Primary:
First one powered up with valid application becomes Primary
If powered up simultaneously and both have valid applications – A becomes Primary
If only one has valid application – it becomes Primary
How to power down?
Stop Standby first to avoid needless rollover

29. HSBY Operation and Rollover Common Rollover Events
Power supply failure on the CPU rack (slowest rollover because of wait for watchdog to time out)
Application program fault that generates a HALT state
Hardware or firmware fault on the CPU module
Hardware or firmware fault on the monitored ETY module
Cable disconnected between the monitored ETY and the first hub/switch
A CPU-sync link failure - (only when PLC is Standby, no rollover if Primary)

30. Migrating from a standalone application
Aspects to consider during a migration:
Hardware
ETY4103/ETY5103 (firmware must be upgraded when migrating)
Non-extendable racks : TSXRKY6 / TSXRKY8 / TSXRKY12
Application program
100 first memory words (%MW) are not exchanged between Primary and Standby
First section in Standby not scanned
No event tasks, rising edges, SAVE_PARAM commands
Ethernet
Do not use consecutive Ethernet addresses in your standalone configuration
Do not use Global Data service/FDR/DHCP service
Testing
PLC will always be designated “A” in standalone -> this must be considered if used in application
CPU-sync link NOK -> since the standby PLC is not present.
Allow for longer CPU scan time (because HSBY CPU takes some time to exchange data between processor and coprocessor):

31. HSBY Operation and Rollover Online Modifications
Reminder: Logic mismatch is not allowed in a Premium Hot Standby system.
PRIMARY is A and STANDBY is B
Modify the application online in the PRIMARY
- The Primary is still active
- Standby goes OFFLINE
Transfer modified application to CPU B
- The Primary is still active
- After transfer, the CPU B is in STOP/OFFLINE A B
RUN command on the B
- The Primary is still active
- After RUN the CPU B is in RUN/STANDBY
RUN
Save application in the PC

32. HSBY Operation and Rollover OS Upgrade Procedure
Reminder : OS mismatch is supported by a Premium Hot Standby system. r
PRIMARY is A and STANDBY is B
Through Unity or the application, set bit 4 of %SW60 on the PRIMARY
RUN
RUN
STOP the PRIMARY A
STANDBY B becomes the PRIMARY
Download the new OS with UNITY LOADER and the application to A A B
Put PLC A in RUN
PLC A becomes the STANDBY
Connect unity on B and STOP the PLC
PLC A becomes PRIMARY / B STANDBY
Download the new OS with UNITY LOADER and the application to B
Put the PLC in RUN
PLC B becomes the STANDBY
Through Unity or the application, reset bit 4 of %SW60 on the PRIMARY

33. HSBY Operation and Rollover Verifying the Health of a Standby System
Hot Standby Diagnostics are displayed in the Status Register of each Hot Standby PLC (%SW61).
More Diagnostic information can be obtained by monitoring PLC States, Module Bits and Words (%S ,%SW).
Diagnostic information can be stored in non-transfer %MW area (%MW0-99).
This Diagnostic information can be sent from Standby to Primary PLC, using the Reverse Transfer Registers (%SW62 - %SW65).
Health Messages are exchanged between the Primary and Standby.
If there is a fault in the Primary, Standby is notified and assumes Primary role.
If there is a fault in the Standby, Primary continues to operate as Standalone.
Monitored ETY Modules periodically verify communication with each other.

34. Functional positioning with Quantum

35. Market segmentation Premium or Quantum HSBY?
Technical characteristics lead to Market positioning
Premium is optimized for:
very high availability and high switching performance over short distances
high availability and non time-critical switching performance over long distances
Quantum is ideal for:
High availability in big applications with good switching time performance
High availability with long distance architecture
High availability in continuous process control
Quantum has options not always mandatory in water or infrastructures

36. Final Comments Launch Site and DMDI
Much information on launch site – go to Planet, search on “Premium”, select “launch site”.
Checklist in DMDI
Marc Lafont will visit from France for a full 2-day training session. Details tbd depending on interest
Survey

37. Any questions?
Thanks for joining us!