High Availability Fieldbus Networks New Physical Layer Technologies Name Job Title Company : Nagesha Nayak : Manager Project Pursuit : Cooper -MTL
What could possibly go wrong? Host H1 Card Control Room Field T Power Supply / Conditioner Device Coupler T 2
Well, there are a few things Short-circuit or open-circuit in trunk cable causes loss of whole segment Control Room Host H1 Card T H1 card: Single point of failure Power Supply / Conditioner Field FF power supply: Single point of failure 3 Open-circuit in spur causes loss of single device Device Coupler T Wiring hub: Single point of failure Short-circuit in spur causes loss of whole segment
Spur short-circuit protection TRUNK + S _ i Current Limit SPUR _ S + Potential shortcircuit i Current limit set at approx 40-60mA, depending on type of Device Coupler 4 Some types turn off spur completely until shortcircuit is removed
Keys to achieving High Availability Avoid unnecessary complexity! Choose inherently reliable apparatus Long Mean Time Between Failures Repair faults as quickly as possible Short Mean Time to Repair Use redundancy, where available Design systems to be inherently resilient to faults Fall back to reduced accuracy/functionality with loss of PV Partition critical processes, eg separate fieldbus segments 5 5
Redundant networks Is specifying redundancy a hang-over from early days of electronics? Electrolytic capacitors with short life-times? Failure of semiconductors at high operating temperatures? Most operators still elect to use redundancy for critical applications Peace of mind Financial impact of down-time vs. cost of redundancy 6 6
Alternative redundancy schemes 1+1 redundancy typically assumed But N+1 redundancy can offer improvements in hardware footprint and installation cost 7 7
N+1 redundancy simplex power at 250mA Module A powers 4 segments at 250mA 8
N+1 redundancy redundant power at 250mA Module A powers 4 segments at 250mA Module B powers 4 segments at 500mA or provides redundancy at 250mA 9
N+1 redundancy redundant power at 500mA Module A powers 4 segments at 250mA Module B powers 4 segments at 500mA or provides redundancy at 250mA Module C Provides redundancy for 4 segments at 500mA 10
N+1 redundancy: complete system 6 modules provide redundant power at 500mA for 8 segments 11
High Energy Trunk with Fieldbus Barrier Zone 1 Benefits Supports long cable lengths and heavily loaded segments Suitable for any Zone or Gas Group Compatible with FISCO and Entity certified IS field devices New generation products allow safer operation and maintenance Compatible with generalpurpose, high density fieldbus power supplies 12
Modern Fieldbus Barrier architecture Pluggable trunk surge protector (optional) Live pluggable 6-spur Fieldbus Barrier modules Pluggable Terminator Trunk terminals Spur surge protector (optional) Trunk Terminal Assembly (TTA) housing Screwsecured, pluggable spur terminals 13
Fieldbus Barrier - Reliability considerations Value Improved productivity; greater competitiveness Benefit Higher reliability; fewer interruptions to production Feature Elimination of internal interconnecting wiring and duplicated terminals/terminator Duplicated Fieldbus Terminators Single Fieldbus Terminator No duplication of wiring terminals Complex switches for module removal 14 Duplicated field wiring terminals Internal hook-up wiring No internal hook-up wiring Isolating switches not required
Fieldbus Barrier Safety considerations Value Establish and maintain reputation as safe operator Benefit Eliminate fire and explosion risks during maintenance Feature All components within main enclosure compartment are live workable in the hazardous area Non-live workable circuits are confined within the Trunk Terminal compartment and protected by a cover Every module and circuit within the shaded area is live-workable in the hazardous area 15
Fieldbus Barrier redundancy: Background Fieldbus Barriers (Isolated Device Couplers) are widely adopted for connection to IS-certified fieldbus instruments in Zone 1 hazardous areas in FOUNDATION TM Fieldbus networks In conventional installations the complex, field-mounted barrier module is not protected by redundancy Most users agree that failure of the fieldbus trunk cable, although theoretically possible, is not a real risk Lack or barrier module redundancy is therefore the most serious concern and diminishes the overall network availability 16
5/6-spur Redundant Fieldbus Barrier Segment Terminator Barrier module A (Spurs default to active state on power-up) Barrier module B (Spurs default to standby state on power-up) Alarm FF device, optionally connected to Spur 6 Fieldbus trunk terminals 17 6 intrinsically-safe spurs
Fieldbus Barrier application with Redundancy Fieldbus control system (DCS) 24V dc Bulk power input Increased safety (Ex e) High Energy trunks Redundant Fieldbus Power Supply CONTROL ROOM Simplex Fieldbus Barrier Redundant Fieldbus Barrier Intrinsically Safe spurs Intrinsically safe FISCO or Entity Fieldbus Devices FIELD Zone 1 18 Non-critical fieldbus segment Critical fieldbus segment
Redundancy Block Diagram Note: Spurs are independently redundant. Failure of a spur in the active module results in fail-over to the equivalent spur in the standby module 19
How does the failure alarm work? Field enclosure incorporates alarm sensing as a Fieldbus Foundation device Alarm device is resident on the same segment as the Fieldbus Barrier Failure of any spur in either Fieldbus Barrier module is detected as a state change in DI function block Automatic fail-over mechanism ensures spurs remain powered without loss of data Intelligent module LED indicators aid module replacement 20
Comparison of system availability Fieldbus Barrier type Mean Time to Repair (MTTR) Availability, % Note 1 Predicted unavailability, minutes per year Note 2 6-spur Simplex 8 hours 99.99276 38 6-spur 99.99905 5 Redundant 6-spur Simplex 72 hours 99.93486 342 6-spur Redundant 99.99626 20 Notes: 1. Availability of a simplex Fieldbus Barrier is calculated according to the formula: Availability, % = 100*MTTF/(MTTF+MTTR). 2. Unavailability is 1-Availability, where 1 year = 525,600 minutes. 3. All calculations at an ambient temperature of 45 o C Conclusions: 1. Redundancy significantly reduces system unavailability (down time) compared with Simplex versions 2. Remote applications with longer Mean Time to Repair see even greater benefit 21
Key Benefits of Redundant Fieldbus Barrier When used with redundant FF power supplies, allows Fieldbus Barriers to be deployed where failure of the fieldbus physical layer is unacceptable Ideal for even the most critical applications: Segments for regulatory control with crucial final elements Safety shutdown systems using FF SIF Achieves better than 99.999% system availability* * Assuming 8 hour Mean Time to Failure 22
Fieldbus Intrinsically Safe Concept (FISCO) Fieldbus control system (DCS) 24Vdc 24Vdc Bulk power input Redundant 4-segment FISCO power supply Intrinsically Safe trunk and spurs (1 segment of 4) CONTROL ROOM FIELD Zone 1 IIB Hazardous area Intrinsically Safe Field wiring hub Intrinsically safe FISCO Fieldbus devices 23
FISCO Power Supply Redundancy Host Control System Host Power A Host Power B H1 Failure Alarm FISCO Power Supply SAM FISCO Power Supply SAM HAND-SHAKING A A B B IS H1 to field IS Megablock IS field instruments 24 Scheme includes Monitoring of Standby FISCO Power Supply and Supply Arbitration Module
Availability analysis Ex technique System Component Availability Unavailability per year, minutes FISCO High Energy Trunk (Fieldbus Barrier) 910x-22 FISCO power supply (redundant) F259 Intrinsically Safe Megablock (10-spur) Typical Redundant FF power supply Typical Fieldbus Barrier 99.99972% 1.5 99.99956% 2.3 99.999% 1.0 (approx) 99.998% 10.0 (approx) Total system unavailability per year, minutes 3.8 11.0 Notes: 1. Calculated figures should be taken as guidance only 2. Power supply availability figures are per segment 3. Ambient operating temperature is assumed to be 20 o C for the power supplies (conditioned control room environment) and 45 o C for the Megablock (field environment). 4. Mean Time to Repair (MTTR) assumed as 8 hours in all cases 5. Megablock availability figure calculated according to the formula: Availability, % = 100*MTTF/(MTTF+MTTR). 6. Unavailability is 1-Availability, where 1 year = 525,600 minutes. 25
In summary. Recent advances in design of Foundation Fieldbus Physical Layer components can increase overall network availability Design of Modern Fieldbus Barriers provides improvements in safety, maintainability and reliability Hardware redundancy plays an important role: Innovative N+1 Power Supply Redundancy Schemes can save capital cost Redundant Fieldbus Barriers can now be chosen as part of an overall strategy to ensure super-high system availability for critical segments 26