Automation Intelligence Enlighten your automation mind..!

Transcription

1 Friends, It brings us immense pleasure to introduce Automation intelligence a knowledge series about automation, innovation, solutions & Technology. This series will discuss about PLC, DCS, Drives, SCADA, HMI, Historian, solutions and everything about Automation. Today in this first issue of Automation intelligence we will discuss about commonly used terminology of REDUNDANCY. When examining an automation system design, the question of redundancy often arises. But what is redundancy, and does it equate to a hot standby system? Redundancy in simple words is "Existence of more than one means for accomplishing a given function. Each means of accomplishing redundancy need not necessarily be identical. Redundancy is a convenient means of elevating global system reliability, and so far its availability. Control System Hi-Availability, that is redundancy, can be addressed at the different levels of the architecture: Single or redundant I/O Modules Depending on the I/O handling philosophy (eg. conventional Remote I/O stations, or I/Os Islands distributed on Ethernet) different scenarios can be applied: dual communication medium I/O Bus or Self healing Ring, single or dual Programmable Controller CPU redundancy Communication network and ports redundancy SCADA System dedicated approaches with multiple operator station location scenarios and resource redundancy capabilities

2 Some Basic types of Redundancy Passive Redundancy: Redundancy wherein a part of the means for performing a required function is intended to operate, while the remaining part(s) of the means are inoperative until needed. Active Redundancy: Active redundancy eliminates performance decline by monitoring performance of individual device. Logic is linked to switching that automatically reconfigures components. Electrical power distribution provides an example of active redundancy. Several power lines connect each generation facility with customers. Each power line includes monitors that detect overload. Each power line also includes circuit breakers. The combination of power lines provides excess capacity. Circuit breakers disconnect a power line when monitors detect an overload. Power is redistributed across the remaining lines. Risk analysis Linked to the previous stakes, the risk analysis is essential to defining the redundancy level. Consider the events the SCADA system will face, i.e. the risk, in terms of the following: Inoperative hardware Inoperative power supply Environmental events (natural disaster, fire) that can imply loss of data, operator screen, connection with devices and so on. Level Definition Finally, the redundancy level is defined as the compilation of the key features, the stakes, and the risk analysis with the customer expectations related to the data criticality level. The following table illustrates the flow from the process analysis to the redundancy level: Redundancy Level State of the standby system Switchover performance No redundancy No standby system Not applicable Cold Standby Warm Standby Hot Standby The Standby system is only powered on if the default system becomes inoperative. The Standby system switches from normal to backup mode. The Standby system runs together with the default system one. Several minutes Large amount of lost data Several seconds Small amount of lost data Transparent No lost data

3 Example: In many safety-critical systems, such as fly-bywire and hydraulic systems in aircraft, some parts of the control system may be triplicate, which is formally termed triple modular redundancy (TMR). An error in one component may then be outvoted by the other two. In a triply redundant system, the system has three sub components, all three of which must fail before the system fails. Since each one rarely fails, and the sub components are expected to fail independently, the probability of all three failing is calculated to be extremely small; often outweighed by other risk factors, e.g., human error. Redundancy in Detail The most basic form of redundancy requires the inclusion of a hand-off-auto switch for each component. In the automatic mode, the plant or system controller runs the process. In the hand mode this step is bypassed, resulting in continued treatment but a loss of efficiency and/or quality. As an alternative, sometimes a process can be bypassed. Using this bypass channel can ensure the plant operates, but it may allow particles to accumulate in the downstream clarifiers and basins. Another form of redundancy exists when more equipment is installed than is required. For instance, three pumps may be provided when only two are needed. This type of redundancy is quite common. Typically the third pump still has its own dedicated starter, VFD and control components. This extends some redundancy to the control and automation system as well. Redundancy is also gained with multiple process trains. Sometimes each train has its own automation system, or trains have been grouped into multiple control panels. This also represents a level of redundancy. Finally, redundancy can be designed into an automation system.

4 Categorizing Redundancy Three Types of Automation Redundancy Automation redundancy can be accomplished via three methods - cold, warm and hot. 1. Cold Redundancy Cold redundancy is for those processes where response time is of minimal concern and may require operator intervention. As an example, take two belt presses, each with its own dedicated control panel. If one belt press becomes inoperable, the operator can resume operation by simply starting the other press. However, when time is more critical, warm or hot redundancy is the best approach. Figure 1: Cold redundancy operation 2. Warm Redundancy Warm redundancy is used where time is somewhat critical but a momentary outage is still acceptable. In this scenario, a momentary bump can be expected. During this bump, the valves, motors and other devices might shutdown temporarily, and the sensors may not report back to the PLC system during the bump. An example of a warm redundancy application may be exemplified on an ATAD system. Warm redundancy systems typically have two processors connected in a primary and standby configuration. The primary processor controls the system s inputs and outputs (I/O) while the standby processor is powered up and waits for Figure 2: Warm redundancy operation

5 the primary processor to stop controlling the process. When this occurs, the standby processor assumes control of the I/O and takes the designation of primary processor, allowing the offline processor to become the secondary processor, and can be maintained without sacrificing process control. During normal operation, the primary processor provides periodic updates to the standby processor. These updates usually occur at the end of each program scan and may only involve a portion of the data at any time. Therefore, when a changeover occurs, the standby processor can work off of incomplete data since it may take the standby processor a few program scans to catch up to where the primary was before the changeover. This can contribute to a bump in the process during the changeover. 3. Hot Redundancy Hot Redundancy is used when the process must not go down for even a brief moment under any circumstance. An example of a hot redundancy system application is a membrane or BAF application. In both instances, the process may not require the hot redundancy capabilities, but during a backwash, redundancy could be critical. During a backwash, a valve reversal, a motor halt or re-sequencing of the valves may cause an incomplete backwash, allow contaminants to enter the clean water, or may even contribute to inoperable equipment. Since none of these scenarios are tolerable, a hot redundancy configuration would be the preferred approach. As stated above, the hardware layout of a hot redundancy system is almost identical to a warm redundancy system. Figure 3: Hot redundancy operation However, hot redundancy systems provide bumpless transfer of the I/O during a changeover from primary to standby. To accomplish this, communication messaging, updating the secondary processor and program execution all have to be properly managed. To ensure that a hot redundancy system operates correctly, data needs to be transferred from the primary processor to the secondary processor with every logic cycle to ensure data integrity.

6 Two methods exist for accomplishing the needed data transfer. 1. Scan and transfer - The first is to perform the transfer at the end of the program scan. Only upon completion of the transfer will the scan resume. While the scan and transfer technique was used for years, and is a reliable and accurate method when properly applied, technological advances have made a new technique possible a method that ensures the transfer does not depend on scan time. 2. Asynchronous transfer - This new method is referred to as asynchronous transfer. In an asynchronous transfer, the primary processor has two separate microprocessors embedded in its circuitry. The first microprocessor executes the program. At the end of the execution, all data is passed to the second microprocessor. This second microprocessor handles all transfer tasks while the first microprocessor executes the next program scan. Thus, one microprocessor is executing while other is transferring data to the standby processor. As this transfer of data from primary processor to secondary processor is asynchronous to the program scan, it now becomes possible to transfer the entire data table without affecting program execution. This eliminates any need to design the program for an optimized scan. Hot Standby Architectures Depending on projects constraints or customer s requirements (performance, installed base or project specifications), a specific Hot Standby PAC station topology can be selected: Hot Standby PAC with in-rack I/O or remote I/O Hot Standby PAC with distributed I/O, connected on Standard Ethernet or connected to another device bus, such as Profibus DP. Hot Standby PAC mixing different topologies A SCADA system can be redundant at the following levels: Clients, i.e. operator stations Data servers Control and information network Targets, i.e. PAC station, controller, devices

7 Hot Standby Switchover Conditions Systematic checks are executed cyclically by any running CPU, in order to detect a potential hardware corruption. Another example of a systematic check is the continuous check of the voltage levels provided by the power supply module(s). In case of a negative result during these hardware health diagnostics, the tested CPU will usually switch to a Stop State. When the unit in question is part of a Hot Standby System, in addition to these standard hardware tests separately executed on both machines, more specific tests are conducted between the units. These additional tests involve both Sync Links. The basic objective is to confirm that the Primary unit is effectively operational, executing the application program, and controlling the I/O exchanges. In addition, the system must verify that the current Standby unit is able to assume control after a switchover. If an abnormal situation occurs on the current Primary unit, it gives up control and switches either to Off-Line state (the CPU is not a part of the Hot Standby system coupling) or to Stop State, depending on the event. The former Standby unit takes control as the new Primary unit. Series-Parallel Systems As an example, assume that one of the 5 modules (1 power supply and 4 other modules) that populate the PLC rack becomes inoperative. As a consequence, the entire rack is affected, as it is no longer 100% capable of performing its assigned mission, regardless of which module is inoperative. Thus each of the 5 modules are considered as a participant member of a 5-part series. When considering Reliability, two components are described as in series if both are necessary to perform a given function. Figure Serial System

8 As an example, assume that the PLC rack now contains redundant Power Supply modules, in addition to the 4 other modules. If one Power Supply becomes inoperative, then the other supplies power for the entire rack. These 2 power supplies would be considered as a parallel subsystem, in turn coupled in series with the sequence of the 4 other modules. Note: Two components are in parallel, from a reliability standpoint, when the system works if at least one of the two components works. In this example, Power Supply 1 and 2 are said to be in active redundancy. Figure Parallel System Serial System Calculations: The computations demonstrate that the combined availability of two components in series is always lower than the availability of its individual components. The following table gives an example of combined availability in serial system: This table indicates that even though a very high availability Part Y was used, the overall availability of the system was reduced by the low availability of Part X. A common saying indicates that "a chain is as strong as the weakest link", however, in this instance a chain is actually weaker than the weakest link. Parallel System Calculations: The above computations indicate that the combined availability of two components in parallel is always higher than the availability of its individual components. The following table gives an example of combined availability in a parallel system:

9 This indicates that even though a very low availability Part X was used, the overall availability of the system is much higher. Thus redundancy provides a very powerful mechanism for making a highly reliable system from low reliability components. Looking at the results of this Parallel System (CPU Rack Redundancy), Reliability over one year would be approximately 99.9%, compared to 97.4% available with a Standalone Premium CPU Rack (i.e. the probability for a Rack System to encounter one failure during one year would have been reduced from 2.6% to 0.1%). System MTBF itself would increase from 335,000 hours (approximately 38 years) to 503,000 hours (approximately 57 years). For System Availability, a 2- hour Mean Time To Repair we provide approximately a 9-nines resulting Availability (almost 100%). Point to be noted Redundancy in process control is critical. However, redundancy is a philosophy, not a set solution. Three methods of redundancy exist today cold, warm and hot. If cessation can be tolerated until the operator can intervene, then cold is best. When the system can handle a slight cessation but automatic intervention is necessary, warm redundancy is the solution. For those operations that cannot experience even a momentary cessation, hot redundancy is the only option. Properly understanding these levels can lead to a reliable system, while minimizing monetary expenditure. From a hardware perspective, warm and hot redundancy systems are almost identical, and can be easily confused when looking at suppliers product data. Care should be taken to carefully examine the different types of systems. So, we learned about some basic of System availability and how to calculate the same. In next issue of Automation Intelligence we will bring you some basics on FDA s 21 CFR-Part 11 compliance. For giving any valuable inputs please feel free to contact Pradeep Ghumre Contact No ID:- pradeep.ghumre@in.schneider-electric.com Schneider Electric India Private Limited, 1141 & 1142, 4 th Floor, Building No. 11, Solitaire corporate park, Andheri Kurla Road, Chakala, Mumbai Office Contact: