Cost-effective Unity Premium Hot Standby Solution

1. Cost-effective Unity Premium Hot Standby Solution Presenter – Tom Royal Americas Business Support End User Domain – Automation BU Call-in number 1-866-758-0236 Passcode 3306817

2. Contents • Overview • Typical architectures • Competition • Sales Arguments and Value Proposition • Migration from Standalone • Targeted applications and opportunities • Operation and Rollover • Positioning with Quantum

3. Introduction What is HSBY? • Automation system keeps running despite a controller failure • Primary PLC with a Standby PLC as backup • Running guaranteed only for the first failure • No guarantee for a second failure in the system (unless the first one is repaired)

4. Introduction HSBY overview • The UNITY Premium Hot Standby System is designed foruse where downtime cannot be tolerated. • Two backplanes are configured with identical hardware, firmware** and application program. • One of the PLCs acts as the Primary. The Primary Controller updates the Standby Controller at the beginning of each scan. • Primary and Standby States are switchable. Either controller can be put in the primary state. • The remote I/O (STB,OTB… ) is never aware of the existence of two PLCs. • The CPU-sync link is a point-to-point connection dedicated to application data exchange and hot standby system diagnostics.

5. ETY ETY ETY ETY ETY ETY Typical Architecture with Redundant I/O & SCADA Network Primary Premium ETG1000 ATV61 Ethernet TCP/IP network #1 STB Modbus Tesys U CPU-syncLink Ethernet I/O Scanner RING VIJEO CITECT OTB XBT-GT Ethernet TCP/IP network #2 Momentum IO Standby Premium

6. Value Propositions Easy to program and operate • Easy to Program • Design and commission as quickly as a standalone application • No specific user programming. • Access to all Unity Pro and IEC1131-3 features • Easy to Operate • Hot Swap and auto-reconfiguration ability for selected I/O modules • Bumpless rollover for selected I/O modules • Transparent rollover for SCADA & HMI (IP swapping) • Efficient • Uses our experience in HSBY systems • Efficient data context exchange (no application programming) • Uses the very powerful Unity Premium hardware • Execution performances

7. Typical Premium HSBY ArchitectureSTB I/O islands over Ethernet • Briefly: • Specific Hot Standby CPUs required. • Hardware redundancy – not software. • CPUs are linked with Ethernet crossover cable. • I/O located remotely through Ethernet • network (ring topology). • Local rack I/O can also be used (redundant) SCADA Premium STANDBY Premium PRIMARY Ethernet I/O ring 10/100 Mbps Advantys STB Modicon M340 Momentum

8. Typical Rockwell ControlLogix ArchitectureFlex I/O islands over ControlNet • Briefly : • Hardware redundancy with a dedicated • redundancy module • Dual attachment topology

9. Typical Siemens architectureET200 I/O islands over Profibus • Briefly : • Software redundancy solution • Dual attachment topology

10. Typical Siemens S7 400H architectureET200 I/O islands over Profibus • Briefly : • Hardware redundancy solution • Dual attachment topology Rack 0 Rack 1 IM 153-2 with ET200M IM 157 with PA bus Y-Link with DP bus

11. Omron CS1D Quantum Hot Standby ETY ETY Premium Hot Standby Siemens S7400H AB ControlLogix Market segmentation Performance Performance Hardware Redundancy Fast S/O on CPU & Rack I/O Fast S/O on Remote I/O Slow S/O on Remote I/O Software redundancy Slow S/O on CPU & Rack I/O SiemensSoftRed Premium WSBY Slow Fast except Small App Fast Very Fast SCAN Time

12. Pricing policy • Comparison of: • Premium HSBY with STB I/O over Ethernet • Siemens SoftRed with ET200 I/O over Profibus • Siemens S7400H with ET200 I/O over Profibus • Rockwell Contrologix with Flex I/O over ControlNet

13. Sales arguments • Strong points of the offer: • High Performance in terms of scan time, CPU & rack I/O performance while keeping “bumpless” warranty (Rockwell / Siemens SoftRed) • Just enough global functionalities for targeted markets (SI) • Flexibility in terms of rollover performances and availability rate • Non-specific HSBY programming (SI – Siemens SoftRed) • IP address swapping and Ethernet choice (SI - Everybody) • Long lasting investment (EU) • Ring topology gives higher redundancy (better than Siemens/Rockwell).

14. Sales arguments • Weak points of the offer (and how to address them): • Fieldbus compatibility with instrumentation (SI). Go through gateways, push architectures with Ethernet compatible devices, move to Quantum • Process stopped while doing heavy process modifications (EU). Address applications where process can be stopped sometimes or where application updates are not requested • No Remote I/O double attachment. Propose in-rack I/O - put I/O island in a cabinet with switch or use remote M340 or move to Q HSBY • No Power Supply redundancy. Duplicate the STB islands or move to Q. • No Automatic Download from Primary to Standby (EU)

15. Worldwide Sales Figures • Global sales • ~100 unit - equally split between the two part numbers. No quality issues so far! • By market segment

16. Infrastructure Water Power Tunnel Airport Targeted Applications • Fault Tolerant Solution for Non Time-critical Applications where: • Production downtime is expensive • Valuable material is processed • Production restart costs are high • Skilled monitoring, maintenance personnel are rare

17. Targeted Application Examples Power production • Hydroelectric dams Road infrastructure • Tunnel Lighting, Ventilation and Signaling • Road Signaling • River infrastructure • Locks • Airport infrastructure • Runway lighting and signaling Water • Water treatment • Desalination

18. HSBY Operation and Rollover Premium Hot Standby System Overview CPU SYNC ETY SYNC ( Monitored ) It is not possible to have non-ambiguous diagnostics of the Premium Hot Standby system with only one link between the two PLCs (CPU-sync link). Therefore an Ethernet module in each PLC is configured, then they’re linked with an Ethernet cable (with or without switches).

19. State of RUN LED dependson the HSBY Mode: • PRIMARY • STANDBY • OFFLINE • STOP • Display Block Indicators: • ERR: faults relating to the Processor Module • RUN: Program Execution States and Hot Standby Mode • I/O: faults on another Station Module or Configuration fault • TER: activity on the Terminal port • ACT: Blinking: indicates communication between Primary and Standby Controllers • STS: Blinking: the System is Redundant and Data are exchanged from Primary to Standby Steady On: the System is not Redundant or Copro is booting from Power-on to end of self-tests Steady Off: Copro Auto Tests Failed HSBY Operation and Rollover Interpreting LED blink patterns

20. HSBY Operation and Rollover System Words & Bits In accordance with IEC Standards, Unity uses global objects called System Bits and System Words: • System Words: • %SW60 - Read / Write the Premium Hot Standby Command Register. • %SW61 – Read the Premium Hot Standby Status Register. • %SW62/63/64/65 - Reverse Registers reserved by the Reverse Transfer process. Written by the Application program Controlled and transferred at each scan to the Primary controller. • %MW0 to %MW99 – Non-Transfer Area

21. HSBY Operation and Rollover Database Transfer Diagram The Database is built automatically by the Primary PLC Operating System and sent at each Primary PLC cycle to the Standby PLC. This exchange is performed via the embedded Ethernet coprocessor of the two HSBY PLCs. Database Redundant Primary Reverse registers • Located Variables (maximum 128 kilobytes) • All Unlocated variables up to 300 kb (depending on the CPU** )

22. HSBY Operation and Rollover Database Transfer Timing - 1 At the start of each scan cycle, the contents of the data memory in the “Primary” PLC are transferred to the “Standby” PLC. 1 – Time required to copy the application data to the communication link layer. 2 – The Hot Standby system is thus able to transfer a data zone from the “Primary” PLC to the “Standby” PLC The Standby PLC refreshes its own OUTPUTs managed in the first section

23. OUTPUT INPUT HSBY Copro Program OUTPUT INPUT HSBY Copro HSBY Operation and Rollover Database Transfer Timing - 2 No impact on the PRIMARY cycle time 1 We use a CYCLIC or a PERIODIC mode and the time to transfer the data is less than the scan time of the PRIMARY. OUTPUT INPUT WAIT + HSBY Copro Data exchange 1 section OUTPUT INPUT WAIT + HSBY Copro Data exchange

24. HSBY Operation and Rollover Database Transfer Timing - 3 PRIMARY cycle time is affected 2 We use a CYCLIC or a PERIODIC mode and the time to transfer the data isgreater than the scan time of the PRIMARY. INPUT INPUT HSBY Copro Effect: Output flickers on in-rack I/O (not I/O Scanning) because the outputs are managed in parallel WAIT + HSBY Copro Data exchange Program OUTPUT 1 section INPUT OUTPUT HSBY Copro + WAIT INPUT WAIT + HSBY Copro Data exchange

25. HSBY Operation and Rollover X-Bus (local) I/O Rollover Time The rollover time is the time between the last update of an output by the old Primary and the first update of that same output by the new Primary. ** ** Worst case for the rollover performance

26. Unity Pro Configuration Information Tab In this screen Hot Standby status is clearly displayed.

27. Unity Pro Configuration Hot Standby Tab “Topological address (slot #) of the monitored Ethernet module”: This dropdown is populated by the addresses of the existing ETY modules.

28. HSBY Operation and Rollover Selection of Primary PLC • A & B designations: • PLC with lowest MAC address in Ethernet copro becomes “A” • MAC1 = 00.80.F4.01.6E.E1 MAC2 = 00.80.B4.01.6E.E1 • Which becomes Primary: • First one powered up with valid application becomes Primary • If powered up simultaneously and both have valid applications – A becomes Primary • If only one has valid application – it becomes Primary • How to power down? • Stop Standby first to avoid needless rollover

29. HSBY Operation and Rollover Common Rollover Events • Power supply failure on the CPU rack (slowest rollover because of wait for watchdog to time out) • Application program fault that generates a HALT state • Hardware or firmware fault on the CPU module • Hardware or firmware fault on the monitored ETY module • Cable disconnected between the monitored ETY and the first hub/switch • A CPU-sync link failure - (only when PLC is Standby, no rollover if Primary)

30. Migrating from a standalone application Aspects to consider during a migration: • Hardware • ETY4103/ETY5103 (firmware must be upgraded when migrating) • Non-extendable racks : TSXRKY6 / TSXRKY8 / TSXRKY12 • Application program • 100 first memory words (%MW) are not exchanged between Primary and Standby • First section in Standby not scanned • No event tasks, rising edges, SAVE_PARAM commands • Ethernet • Do not use consecutive Ethernet addresses in your standalone configuration • Do not use Global Data service/FDR/DHCP service • Testing • Do not use consecutive Ethernet addresses in your standalone configuration • PLC will always be designated “A” in standalone -> this must be considered if used in application • CPU-sync link NOK -> since the standby PLC is not present. • Allow for longer CPU scan time (because HSBY CPU takes some time to exchange data between processor and coprocessor):

31. Modify the application online in the PRIMARY - The Primary is still active - Standby goes OFFLINE RUN • Save application in the PC • Transfer modified application to CPU B - The Primary is still active - After transfer, the CPU B is in STOP/OFFLINE • RUN command on the B - The Primary is still active - After RUN the CPU B is in RUN/STANDBY HSBY Operation and Rollover Online Modifications Reminder: Logic mismatch is not allowed in a Premium Hot Standby system. • PRIMARY is A and STANDBY is B B A

32. STOP the PRIMARY A • STANDBY B becomes the PRIMARY • Put PLC A in RUN • PLC A becomes the STANDBY • Connect unity on B and STOP the PLC • PLC A becomes PRIMARY / B STANDBY HSBY Operation and Rollover OS Upgrade Procedure Reminder : OS mismatch is supported by a Premium Hot Standby system. • PRIMARY is A and STANDBY is B r • Through Unity or the application, set bit 4 of %SW60 on the PRIMARY RUN RUN • Download the new OS with UNITY LOADER and the application to A B A • Download the new OS with UNITY LOADER and the application to B • Put the PLC in RUN • PLC B becomes the STANDBY • Through Unity or the application, reset bit 4 of %SW60 on the PRIMARY

33. HSBY Operation and Rollover Verifying the Health of a Standby System • Hot Standby Diagnostics are displayed in the Status Registerof each Hot Standby PLC (%SW61). • More Diagnostic information can be obtained by monitoring PLC States, Module Bits and Words (%S ,%SW). • Diagnostic information can be stored in non-transfer %MW area (%MW0-99). • This Diagnostic information can be sent from Standby to Primary PLC, using the Reverse Transfer Registers (%SW62 - %SW65). • Health Messages are exchanged between the Primary and Standby. • If there is a fault in the Primary, Standby is notified and assumes Primary role. • If there is a fault in the Standby, Primary continues to operate as Standalone. • Monitored ETY Modules periodically verify communication with each other.

34. Functional positioning with Quantum

35. Market segmentation Premium or Quantum HSBY? Technical characteristics lead to Market positioning • Premium is optimized for: • very high availability and high switching performance over short distances • high availability and non time-critical switching performance over long distances • Quantum is ideal for: • High availability in big applications with good switching time performance • High availability with long distance architecture • High availability in continuous process control • Quantum has options not always mandatory in water or infrastructures

36. Final Comments Launch Site and DMDI • Much information on launch site – go to Planet, search on “Premium”, select “launch site”. • Checklist in DMDI • Marc Lafont will visit from France for a full 2-day training session. Details tbd depending on interest • Survey

37. Any questions? Thanks for joining us!