Cost-effective Unity Premium Hot Standby Solution Presenter – Tom Royal Americas Business Support End User Domain – Automation BU Call-in number 1-866-758-0236 Passcode 3306817

Contents Overview Typical architectures Competition Sales Arguments and Value Proposition Migration from Standalone Targeted applications and opportunities Operation and Rollover Positioning with Quantum

Introduction What is HSBY? Automation system keeps running despite a controller failure Primary PLC with a Standby PLC as backup Running guaranteed only for the first failure No guarantee for a second failure in the system (unless the first one is repaired)

Introduction HSBY overview The UNITY Premium Hot Standby System is designed for use where downtime cannot be tolerated. Two backplanes are configured with identical hardware, firmware** and application program. One of the PLCs acts as the Primary. The Primary Controller updates the Standby Controller at the beginning of each scan. Primary and Standby States are switchable. Either controller can be put in the primary state. The remote I/O (STB,OTB… ) is never aware of the existence of two PLCs. The CPU-sync link is a point-to-point connection dedicated to application data exchange and hot standby system diagnostics.

Typical Architecture with Redundant I/O & SCADA Network Primary Premium ETG1000 ATV61 Ethernet TCP/IP network #1 STB ETY Modbus Tesys U CPU-sync Link Ethernet I/O Scanner RING VIJEO CITECT OTB ETY XBT-GT Ethernet TCP/IP network #2 Momentum IO Standby Premium

Value Propositions Easy to program and operate Design and commission as quickly as a standalone application No specific user programming. Access to all Unity Pro and IEC1131-3 features Easy to Operate Hot Swap and auto-reconfiguration ability for selected I/O modules Bumpless rollover for selected I/O modules Transparent rollover for SCADA & HMI (IP swapping) Efficient Uses our experience in HSBY systems Efficient data context exchange (no application programming) Uses the very powerful Unity Premium hardware Execution performances

Typical Premium HSBY Architecture STB I/O islands over Ethernet Briefly: Specific Hot Standby CPUs required. Hardware redundancy – not software. CPUs are linked with Ethernet crossover cable. I/O located remotely through Ethernet network (ring topology). Local rack I/O can also be used (redundant) SCADA Premium PRIMARY Premium STANDBY Ethernet I/O ring 10/100 Mbps Modicon M340 Advantys STB Momentum

Typical Rockwell ControlLogix Architecture Flex I/O islands over ControlNet Briefly : Hardware redundancy with a dedicated redundancy module Dual attachment topology

Typical Siemens architecture ET200 I/O islands over Profibus Briefly : Software redundancy solution Dual attachment topology

Typical Siemens S7 400H architecture ET200 I/O islands over Profibus Briefly : Hardware redundancy solution Dual attachment topology Rack 0 Rack 1 IM 153-2 with ET200M IM 157 with PA bus Y-Link with DP bus

Market segmentation Performance Hardware Redundancy Fast S/O on CPU & Rack I/O Fast S/O on Remote I/O Siemens S7400H Quantum Hot Standby AB ControlLogix Slow S/O on Remote I/O Omron CS1D ETY Premium Hot Standby Software redundancy Slow S/O on CPU & Rack I/O SiemensSoftRed Premium WSBY Slow Fast except Small App Fast Very Fast SCAN Time

Pricing policy Comparison of: Premium HSBY with STB I/O over Ethernet Siemens SoftRed with ET200 I/O over Profibus Siemens S7400H with ET200 I/O over Profibus Rockwell Contrologix with Flex I/O over ControlNet

Sales arguments Strong points of the offer: High Performance in terms of scan time, CPU & rack I/O performance while keeping “bumpless” warranty (Rockwell / Siemens SoftRed) Just enough global functionalities for targeted markets (SI) Flexibility in terms of rollover performances and availability rate Non-specific HSBY programming (SI – Siemens SoftRed) IP address swapping and Ethernet choice (SI - Everybody) Long lasting investment (EU) Ring topology gives higher redundancy (better than Siemens/Rockwell).

Sales arguments Weak points of the offer (and how to address them): Fieldbus compatibility with instrumentation (SI). Go through gateways, push architectures with Ethernet compatible devices, move to Quantum Process stopped while doing heavy process modifications (EU). Address applications where process can be stopped sometimes or where application updates are not requested No Remote I/O double attachment. Propose in-rack I/O - put I/O island in a cabinet with switch or use remote M340 or move to Q HSBY No Power Supply redundancy. Duplicate the STB islands or move to Q. No Automatic Download from Primary to Standby (EU)

Worldwide Sales Figures Global sales ~100 unit - equally split between the two part numbers. No quality issues so far! By market segment

Targeted Applications Fault Tolerant Solution for Non Time-critical Applications where: Production downtime is expensive Valuable material is processed Production restart costs are high Skilled monitoring, maintenance personnel are rare Infrastructure Power Tunnel Airport Water

Targeted Application Examples Water Water treatment Desalination Power production Hydroelectric dams Road infrastructure Tunnel Lighting, Ventilation and Signaling Road Signaling River infrastructure Locks Airport infrastructure Runway lighting and signaling

HSBY Operation and Rollover Premium Hot Standby System Overview CPU SYNC ETY SYNC ( Monitored ) It is not possible to have non-ambiguous diagnostics of the Premium Hot Standby system with only one link between the two PLCs (CPU-sync link). Therefore an Ethernet module in each PLC is configured, then they’re linked with an Ethernet cable (with or without switches).

HSBY Operation and Rollover Interpreting LED blink patterns Display Block Indicators: ERR: faults relating to the Processor Module RUN: Program Execution States and Hot Standby Mode I/O: faults on another Station Module or Configuration fault TER: activity on the Terminal port ACT: Blinking: indicates communication between Primary and Standby Controllers STS: Blinking: the System is Redundant and Data are exchanged from Primary to Standby Steady On: the System is not Redundant or Copro is booting from Power-on to end of self-tests Steady Off: Copro Auto Tests Failed State of RUN LED depends on the HSBY Mode: PRIMARY STANDBY OFFLINE STOP

HSBY Operation and Rollover System Words & Bits In accordance with IEC Standards, Unity uses global objects called System Bits and System Words: System Words: %SW60 - Read / Write the Premium Hot Standby Command Register. %SW61 – Read the Premium Hot Standby Status Register. %SW62/63/64/65 - Reverse Registers reserved by the Reverse Transfer process. Written by the Application program Controlled and transferred at each scan to the Primary controller. %MW0 to %MW99 – Non-Transfer Area

HSBY Operation and Rollover Database Transfer Diagram The Database is built automatically by the Primary PLC Operating System and sent at each Primary PLC cycle to the Standby PLC. This exchange is performed via the embedded Ethernet coprocessor of the two HSBY PLCs. Database Primary Redundant Reverse registers Located Variables (maximum 128 kilobytes) All Unlocated variables up to 300 kb (depending on the CPU** ) **CPU Max data size TSX H57 24 M 193 kbytes TSX H57 44 M 440 kbytes

HSBY Operation and Rollover Database Transfer Timing - 1 At the start of each scan cycle, the contents of the data memory in the “Primary” PLC are transferred to the “Standby” PLC. 1 – Time required to copy the application data to the communication link layer. 2 – The Hot Standby system is thus able to transfer a data zone from the “Primary” PLC to the “Standby” PLC The Standby PLC refreshes its own OUTPUTs managed in the first section

HSBY Operation and Rollover Database Transfer Timing - 2 No impact on the PRIMARY cycle time 1 We use a CYCLIC or a PERIODIC mode and the time to transfer the data is less than the scan time of the PRIMARY. INPUT HSBY Copro Program OUTPUT OUTPUT INPUT WAIT + HSBY Copro Data exchange 1 section OUTPUT INPUT WAIT + HSBY Copro Data exchange

HSBY Operation and Rollover Database Transfer Timing - 3 PRIMARY cycle time is affected 2 We use a CYCLIC or a PERIODIC mode and the time to transfer the data is greater than the scan time of the PRIMARY. INPUT INPUT HSBY Copro Effect: Output flickers on in-rack I/O (not I/O Scanning) because the outputs are managed in parallel WAIT + HSBY Copro Program Data exchange OUTPUT 1 section INPUT OUTPUT HSBY Copro + WAIT INPUT Data exchange WAIT + HSBY Copro

HSBY Operation and Rollover X-Bus (local) I/O Rollover Time The rollover time is the time between the last update of an output by the old Primary and the first update of that same output by the new Primary. ** ** Worst case for the rollover performance

Unity Pro Configuration Information Tab In this screen Hot Standby status is clearly displayed.

Unity Pro Configuration Hot Standby Tab “Topological address (slot #) of the monitored Ethernet module”: This dropdown is populated by the addresses of the existing ETY modules.

HSBY Operation and Rollover Selection of Primary PLC A & B designations: PLC with lowest MAC address in Ethernet copro becomes “A” MAC1 = 00.80.F4.01.6E.E1 MAC2 = 00.80.B4.01.6E.E1 Which becomes Primary: First one powered up with valid application becomes Primary If powered up simultaneously and both have valid applications – A becomes Primary If only one has valid application – it becomes Primary How to power down? Stop Standby first to avoid needless rollover

HSBY Operation and Rollover Common Rollover Events Power supply failure on the CPU rack (slowest rollover because of wait for watchdog to time out) Application program fault that generates a HALT state Hardware or firmware fault on the CPU module Hardware or firmware fault on the monitored ETY module Cable disconnected between the monitored ETY and the first hub/switch A CPU-sync link failure - (only when PLC is Standby, no rollover if Primary)

Migrating from a standalone application Aspects to consider during a migration: Hardware ETY4103/ETY5103 (firmware must be upgraded when migrating) Non-extendable racks : TSXRKY6 / TSXRKY8 / TSXRKY12 Application program 100 first memory words (%MW) are not exchanged between Primary and Standby First section in Standby not scanned No event tasks, rising edges, SAVE_PARAM commands Ethernet Do not use consecutive Ethernet addresses in your standalone configuration Do not use Global Data service/FDR/DHCP service Testing PLC will always be designated “A” in standalone -> this must be considered if used in application CPU-sync link NOK -> since the standby PLC is not present. Allow for longer CPU scan time (because HSBY CPU takes some time to exchange data between processor and coprocessor):

HSBY Operation and Rollover Online Modifications Reminder: Logic mismatch is not allowed in a Premium Hot Standby system. PRIMARY is A and STANDBY is B Modify the application online in the PRIMARY - The Primary is still active - Standby goes OFFLINE Transfer modified application to CPU B - The Primary is still active - After transfer, the CPU B is in STOP/OFFLINE A B RUN command on the B - The Primary is still active - After RUN the CPU B is in RUN/STANDBY RUN Save application in the PC

HSBY Operation and Rollover OS Upgrade Procedure Reminder : OS mismatch is supported by a Premium Hot Standby system. r PRIMARY is A and STANDBY is B Through Unity or the application, set bit 4 of %SW60 on the PRIMARY RUN RUN STOP the PRIMARY A STANDBY B becomes the PRIMARY Download the new OS with UNITY LOADER and the application to A A B Put PLC A in RUN PLC A becomes the STANDBY Connect unity on B and STOP the PLC PLC A becomes PRIMARY / B STANDBY Download the new OS with UNITY LOADER and the application to B Put the PLC in RUN PLC B becomes the STANDBY Through Unity or the application, reset bit 4 of %SW60 on the PRIMARY

HSBY Operation and Rollover Verifying the Health of a Standby System Hot Standby Diagnostics are displayed in the Status Register of each Hot Standby PLC (%SW61). More Diagnostic information can be obtained by monitoring PLC States, Module Bits and Words (%S ,%SW). Diagnostic information can be stored in non-transfer %MW area (%MW0-99). This Diagnostic information can be sent from Standby to Primary PLC, using the Reverse Transfer Registers (%SW62 - %SW65). Health Messages are exchanged between the Primary and Standby. If there is a fault in the Primary, Standby is notified and assumes Primary role. If there is a fault in the Standby, Primary continues to operate as Standalone. Monitored ETY Modules periodically verify communication with each other.

Functional positioning with Quantum

Market segmentation Premium or Quantum HSBY? Technical characteristics lead to Market positioning Premium is optimized for: very high availability and high switching performance over short distances high availability and non time-critical switching performance over long distances Quantum is ideal for: High availability in big applications with good switching time performance High availability with long distance architecture High availability in continuous process control Quantum has options not always mandatory in water or infrastructures

Final Comments Launch Site and DMDI Much information on launch site – go to Planet, search on “Premium”, select “launch site”. Checklist in DMDI Marc Lafont will visit from France for a full 2-day training session. Details tbd depending on interest Survey

Any questions? Thanks for joining us!