RSView SE V4.0 (CPR7+) Server Redundancy Guidelines

RSView SE V4.0 (CPR7+) Server Redundancy Guidelines

This page left intentionally blank. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 2 of 17

Table of Contents Introduction...4 New in CPR7+: HMI Server Replication...4 Configuration & Operation & Tips...5 Terminology...5 Recommended System Topologies...5 Revision Maintenance of RSView SE...6 Setting up a Redundant RSView SE System...6 Starting a Redundant RSView SE System...12 References...17 RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 3 of 17

Introduction This document serves as a supplement to Chapter 26: Setting up a redundant system in the RSView Supervisory Edition User's Guide Volume 2 (July 2005). Its purpose is to: introduce the new redundancy features of CPR7+ (May 2006) provide supplemental Configuration, Operation and Troubleshooting tips for redundant SE 4.0 systems The User s Guide is considered prerequisite reading for this document. New in CPR7+: HMI Server Replication This information supersedes the section of the User s Guide entitled Synchronizing project files on page 26-8. Prior to CPR7+, changes to a primary HMI Server were typically transferred to the secondary HMI Server using 1 of 2 methods: 1. a manual file copy using Windows Explorer, which required the HMI project to be unloaded first 2. the HMI Backup Utility, which allow the HMI project to remain loaded While a manual file copy is still useful for transferring minor changes (e.g., a single display) from a primary HMI Server to a secondary HMI Server, CPR7+ adds HMI Server replication to ensure that the complete HMI Project is always transferred. To perform a Replication, open RSView Studio and go to the 'Redundancy' tab of the 'Properties ' dialog of the HMI server that you are interested in replicating: For more information on HMI Server Replication (and all of the features of CPR7+), see Rockwell Automation Knowledgebase Answer ID 34215 - CPR7+ Runtime Editing improvements, HMI Redundancy replication, and String Spreadsheet editing. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 4 of 17

Configuration & Operation & Tips Terminology The following terms are used in this document. When the term is used, its meaning is as follows: Active mode The server is active and ready to serve data or HMI components to the clients. Clients can only connect to a server that is in active mode. Alarm state synchronization HMI servers in a redundant server pair keep alarm information synchronized between the two server computers. This occurs via alarm state synchronization. Fail-over HMI switchback delay On active macro On standby macro When the active server fails, the process to switch the active server state to the standby server is called fail-over. When a primary HMI server comes back online after a failure or shutdown, there is a configurable delay to allow alarm state synchronization to occur before clients can connect to the primary server. The default is two minutes and can be configured through a registry key. The On active macro is run when an HMI server transitions to active mode, either on boot or from standby mode. The commands in the On active macro should include components that should only be run when an HMI server is active. Examples of services that should be run when a server becomes active include: data logging, derived tags and event detector. The On standby macro is run when an HMI server transitions to standby mode, either on boot or from active mode. The commands in the On standby macro should include components that should only be run when an HMI server is standby or shutting down services that are active server components. Examples of services that should be shut down when a server becomes standby include: data logging, derived tags and event detector. ServerPing Standby mode Switchback Reboot Determines the status of all the software and hardware in a distributed SE application The server is standby and monitoring the status of the active server. In HMI servers, standby servers maintain a synchronized alarm state to quickly provide accurate alarm information when a fail-over occurs. Clients cannot connect to a server in standby mode. When the primary server comes back online after a failure or shutdown, the process to switch the active server from the secondary to the primary server is called switchback. Whenever this document refers to rebooting a server computer, it is recommended that a Windows shutdown is performed. Once the machine is shut down, then the computer should be powered back on. This ensures that Windows does not hold on to incorrect information in memory. Recommended System Topologies Refer to Planning the layout of a redundant system in Chapter 26 in the RSView Supervisory Edition User's Guide for sample architectures. These are only guidelines and variations on these architectures may also be acceptable. Be sure to consider CPU loading factors and server activity when creating your redundant system architecture. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 5 of 17

Revision Maintenance of RSView SE In a distributed RSView SE system, it is critical that all computers have the same version of the software (including post-release patches). Prior to configuring redundancy, you should update all RSView SE computers up with the latest patches and verify that all computers are at the same level. See AID 35680 RSView SE 4.0 (CPR7) - Patch Roll-up. Setting up a Redundant RSView SE System The following sections provide additional detail to the RSView Supervisory Edition User's Guide section entitled Setting up a redundant RSView SE system on page 26-1. Prior to completing the steps below, you must have already created your FactoryTalk Application and HMI project(s) and Data Server(s). For details, refer to the RSView Supervisory Edition User's Guide, Chapter 5: Working with Distributed Applications. Configuring a Redundant HMI Server The steps that should be performed to configure a redundant HMI server are as follows: 1. Copy the HMI project files from the primary HMI Server to the identical location on the designated secondary HMI Server. For details, see Moving HMI project files on page 27-6 of the RSView Supervisory Edition User's Guide. 2. Launch RSView Studio. Note: RSView Studio may be launched on the primary HMI Server, secondary HMI Server, or virtually any remote computer that uses the same FactoryTalk Directory as the HMI Servers. 3. In the Product Type Selection dialog, select SE Distributed and click Continue. You may be prompted to Log On to FactoryTalk. Note: If you are not prompted to log on, then FactoryTalk s Single Sign-on feature is enabled and configured. For more information on FactoryTalk Security, please refer to the RSView Supervisory Edition User's Guide, Chapter 15: Setting up security. 4. Log On to FactoryTalk as an administrator. 5. In New/Open SE Distributed Application dialog: select the Existing tab select your Application select your Language click Open. 6. When your application has opened, right click on the HMI server you want to make redundant and select Properties The HMI Server Properties page for the selected HMI server will open. 7. On the HMI Server Properties General tab, change the Startup type to Load and run startup components when operating system initializes (Redundancy cannot be configured if this option is set to On demand): RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 6 of 17

8. Click Apply to save the Startup type setting. 9. Select the Redundancy tab and click the Provide redundancy using a secondary server checkbox to turn redundancy on for the selected HMI server. In the Computer hosting the secondary server field, enter the name of the computer that will host the secondary server: 10. Click Apply to save the changes to your HMI Server properties. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 7 of 17

11. Select the Components tab and configure your On startup components. Note: In a non-redundant system, enabled On startup components would typically include Alarming, Data logging, Derived tags and Events. However, in a redundant system, Alarming is the typically the only component that runs on both the Active and Standby servers. The remaining components are typically running only on the Active server and are therefore started in the On active macro and stopped in the On standby macro. Only components that should be running on both the Active and Standby servers should be configured in the On startup components. 12. Configure an On active macro for commands that should be run when the server becomes Active (this includes startup). Note: If you have checked the Alarming checkbox, you do not need to place the AlarmOn command in the On active macro. 13. Configure an On standby macro for commands that should be run when the server becomes Standby. 14. Click Apply to save the changes to your HMI Server Components configuration. 15. Return to the Redundancy tab and click Replicate Primary to Secondary Read the information provided and click Yes to continue. This will transfer the Components configuration you just completed to the secondary HMI computer and verify that the setup is correct and that the replication feature is working properly. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 8 of 17

Configuring a Redundant RSLinx Enterprise Data Server The steps that should be performed to configure a redundant RSLinx Enterprise Server are as follows: 1. Launch RSView Studio. Note: RSView Studio may be launched on the primary Data Server, secondary Data Server, or virtually any remote computer that uses the same FactoryTalk Directory as the Data Servers. 2. In the Product Type Selection dialog, select SE Distributed and click Continue. You may be prompted to Log On to FactoryTalk. Note: If you are not prompted to log on, then FactoryTalk s Single Sign-on feature is enabled and configured. For more information on FactoryTalk Security, please refer to the RSView Supervisory Edition User's Guide, Chapter 15: Setting up security. 3. Log On to FactoryTalk as an administrator. 4. When your application has opened, right click on the RSLinx Enterprise data server you want to make a redundant server and select Properties and the RSLinx Enterprise Server Properties page for the selected RSLinx Enterprise server will open. 5. Select the Redundancy tab to configure a secondary RSLinx Enterprise data server. 6. Click the Provide redundancy using a secondary server checkbox to turn redundancy on for the selected RSLinx Enterprise server. In the Computer hosting the secondary server field, enter the name of the computer that will host the secondary server: Note: The default Switch back option is Continue using the secondary server... This means that when your primary server fails or is shutdown, the secondary server will become the active server. When your primary server comes back online, the secondary RSLinx Enterprise Data Server will continue to function as your active data server and clients will remain connected to the secondary. When Continue using the secondary server is selected, you must shutdown the secondary server computer to switch from the secondary back to the primary as the active RSLinx Enterprise data server. Selecting the Switchback to primary server option means that when the primary server comes back online, the primary will automatically become active and the switchback from the secondary server will occur without user intervention. 7. Click OK to save the changes you have made to the RSLinx Enterprise Server properties and close the properties dialog. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 9 of 17

8. Double-click on the Communication Setup icon in the Application Explorer to launch the Communication Setup dialog shown below: 9. In the Primary tab, you will have configured the RSLinx Enterprise device shortcuts for your primary server. Click the Secondary tab and configure the same device shortcut on your secondary computer. Note: RSLinx Enterprise software must be installed on the secondary Data Server. 10. Click Apply to save the new shortcut then OK to save the Communication Setup information. Configuring a Redundant OPC Data Server The steps that should be performed to configure a redundant OPC Data Server are as follows: 1. Copy the OPC Data Server project files to the proper location on the designated secondary Data Server. For details, see Moving data server files on page 27-12 of the RSView Supervisory Edition User's Guide. 2. Launch RSView Studio. Note: RSView Studio may be launched on the primary OPC Data Server, secondary OPC Data Server, or virtually any remote computer that uses the same FactoryTalk Directory as the OPC Data Servers. 3. In the Product Type Selection dialog, select SE Distributed and click Continue. You may be prompted to Log On to FactoryTalk. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 10 of 17

Note: If you are not prompted to log on, then FactoryTalk s Single Sign-on feature is enabled and configured. For more information on FactoryTalk Security, please refer to the RSView Supervisory Edition User's Guide, Chapter 15: Setting up security. 4. Log On to FactoryTalk as an administrator. 5. When your application has opened, right click on the OPC Data Server you want to make a redundant server and select Properties and the OPC Server Properties page for the selected OPC server will open. 6. Select the Redundancy tab to configure a secondary OPC data server. 7. Click the Provide redundancy using a secondary server checkbox to turn redundancy on for the selected OPC server. In the Computer hosting the secondary server field, enter the name of the computer that will host the secondary server: Note: The default Switch back option is Continue using the secondary server This means that when your primary server fails or is shutdown, the secondary server will become the active server. When your primary server comes back online, the secondary OPC data server will continue to function as your active data server and clients will remain connect to the secondary. When Continue using the secondary server is selected, you must shutdown the secondary server computer to switch from the secondary back to the primary as the active OPC data server. Selecting the Switchback to the primary server when it becomes available again option means that when the primary server comes back online, the primary will automatically become active and the switchback from the secondary server will occur without user intervention. 8. Click OK to save the changes you have made to the OPC Server properties and close the properties dialog. Note: Any future changes to the configuration of RSLinx on the primary Data Server must be duplicated on the secondary Data Server. This can be accomplished by using the RSLinx GUI locally on both servers, or by backing up the changes on the primary and restoring them on the secondary. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 11 of 17

Starting a Redundant RSView SE System When initializing/deploying a distributed system with redundancy, the boot order is important. Each software component should have all services fully initialized before proceeding to the next step. For more information, see AID 38087 - Recommended Startup Procedure for FactoryTalk Distributed Architectures. Behavior at Startup When the computer hosting the primary HMI server is booted, the FactoryTalk Directory informs all the computers in the application that the HMI or OPC data server is starting. When the server has finished starting, the FactoryTalk Directory informs all the computers in the application that the server is active and all the clients should be using that server. If HMI alarming is configured to start in the component startup or in the startup macro, then alarming will start putting all the tags on scan. For all tag requests all tag items will be added to both the primary and secondary data server OPC groups. Just the primary data server will activate the tags (put tags on scan). The On active macro will be run on the primary HMI server computer as it is now active. Once all the alarmed tags are on scan, the alarm state will be synchronized to the secondary HMI server. When the alarms are synchronized to the secondary HMI server, the tags will be put on scan on the secondary HMI server to ensure a quick failover in case the primary HMI server fails. The On standby macro will be run on the secondary HMI server computer as it is standby. Determining Active and Standby Server The following methods can be used to determine the active and standby servers in the redundant server pair: 1. RSView Studio 2. RSView Administration Console. 3. A display on the SE Client 4. The FactoryTalk diagnostics viewer Note: RSLinx Enterprise, RSLinx for RSView, and third-party OPC data server status cannot be viewed in RSView Studio or the RSView Administration Console. To view HMI Server status using RSView Studio or the RSView Administration Console: Open RSView Studio from the Windows Start\Programs menu. In the Product Type Selection dialog, select SE Distributed and click Continue. In New/Open SE Distributed Application dialog, select the Existing, select your application and click Open. When your application has opened, right click on the HMI server for which you want to view status information. The bottom section of the HMI Server Properties General tab shows the Server status for both the primary and secondary HMI Servers. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 12 of 17

The possible server states are: Active: displayed when the server is the active server Standby: displayed when the server is the standby server Unknown: displayed when a server has not been configured Out of Service: displayed when the server is configured but the host computer is off-line or the HMI server is not running on the host computer To view HMI and Data Server status using the SE Client: If you would like to display active and standby server status for both HMI and Data Servers in the SE Client at runtime, you can do so using the Display Client Object Model. See AID 27597 - Determine Active and Standby Server Status using the RSView SE Client for more information. To view HMI and Data Server status using the FactoryTalk Diagnostics Viewer: From the Windows Start menu, select Programs, Rockwell Software, Utilities, Diagnostics Viewer to open the FactoryTalk Diagnostics Viewer Move the scroll bar for the Diagnostics List to the bottom of the list of system events. Messages should be displayed that show whether your server is active or standby. In the example below, the secondary HMI server USCST7PLUSSEC in the application Redundancy Technote has become active at 11:04:01 AM: RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 13 of 17

HMI Server Fail-over and Switchback Fail-over Process The following process occurs when an HMI Server fails: The secondary HMI server observes that the primary HMI server is no longer available so the secondary HMI server determines that it will become active The On Active macro is run on the secondary HMI server\ The clients observe that the primary HMI server is no longer available, so the clients switch to the second HMI server. Switchback from Secondary to Primary The following process occurs when an HMI Server switches back from the secondary to the primary: Note: It is recommended that the primary computer be rebooted before you perform a switchback. This is because there is a delay on switchback when rebooting to give the primary HMI server time to put all the alarms on scan and transfer the alarm state from the active server to the secondary server. Reboot primary HMI server The primary HMI server is available once all the services are loaded The primary HMI server will get the current alarm state from the active secondary HMI server Once the alarm state is synchronized, the primary HMI server will put all the alarmed tags on scan Once the switchback delay has expired, the On active macro will be run on the primary HMI server. Note: The default switchback delay is two minutes. See HMI Server Switchback delay for more information on configuring the switchback delay RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 14 of 17

All the clients will switch over to the primary HMI server Any alarm transactions that were buffered during the switchback will be processed. All the clients will show the alarm information from the primary HMI server If the clients show a blank alarm summary this is because the clients have switched over to the primary HMI server but the alarm state synchronization had not finished. No alarm summary information is shown rather than showing incomplete alarm summary information. Alarm transactions that occur during the switchback are buffered to be processed with the newly synchronized alarm state Once the switchback is complete and all clients are connected to the primary HMI server, reboot the secondary HMI server to ensure it is ready to serve clients in a future failover. HMI Server Switchback Delay The default HMI server switchback delay is 2 minutes. This has been tested with medium to large scale applications. This delay should be increased when the alarm summary on clients is empty for a long period of time after a reboot of the primary HMI server. To change the ServerPing configuration, select Run from the Windows Start menu and type Regedit to bring up registry editor Navigate to the registry key [HKEY_LOCAL_MACHINE\SOFTWARE\Rockwell Software\RNA\ServerPing] Right click on the key ServerPing and select New > DWORD Value Type "ReadyTimeout" Double-click on ReadyTimeout Change Value Data: from 0 to a new number in minutes Data Server Fail-over and Switchback Fail-over Process The following process occurs when an Active Data Server fails. In this example, the primary data server is the active server: The secondary data server observes that the primary data server is no longer available so the secondary data server determines that it will become active The secondary data server activates all items in its OPC group (puts its tags on scan) The clients observe that the primary data server is no longer available, so the clients switch to the secondary data server. RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 15 of 17

Continue Using Secondary Server The following process occurs when a primary Data Server returns to service when the data server is configured to "Continue using the secondary server even when the primary server becomes available again": It is recommended that the primary computer be rebooted after a failure occurs. The primary data server is available once all the services are loaded The secondary data server will remain active The primary HMI server will go into standby mode All the clients will remain connected to the secondary data server To switch back the data server to the primary manually stop the data server on the secondary. Switchback to Primary Server The following process occurs when a primary Data Server returns to service when the data server is configured to "Switchback to primary server when it becomes available again": It is recommended that the primary computer be rebooted after a failure occurs. The primary data server is available once all the services are loaded. When the primary data server is available, it will become the active data server. All the items will have to be added to the OPC groups from all the client displays and HMI server components (alarming, data logging...) Activate all the newly added items. This could take some time. The secondary data server will go into standby mode. All the clients will connect to the primary data server. Once the switchback is complete and all clients are connected to the primary data server, reboot the secondary data server to ensure it is ready to serve clients in a future failover. Testing Server Redundancy RSView HMI Server Redundancy protects against the failure of the HMI Server or the computer that the HMI server is running on. To protect against network failures use redundant media and a NIC card that supports redundant media such as the Intel Pro/100 S Dual Port Server Adapter, http://www.intel.com/support/network/adapter/pro100/pro100sdp/index.htm. To simulate a HMI Server failure, do one of the following: Turn off the primary HMI server computer Shutdown the primary HMI server computer RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 16 of 17

References RSView Supervisory Edition Installation Guide http://literature.rockwellautomation.com/idc/groups/literature/documents/in/viewse-in003_-en-p.pdf RSView Supervisory Edition User's Guide Volume 1 http://literature.rockwellautomation.com/idc/groups/literature/documents/um/viewse-um004_-en-e.pdf RSView Supervisory Edition User's Guide Volume 2 http://literature.rockwellautomation.com/idc/groups/literature/documents/um/viewse-um005_-en-e.pdf RSView SE 4.0 (CPR7+) Server Redundancy Guidelines.doc 2/14/2007 Page 17 of 17