s7 400 Redundancy
s7 400 Redundancy
Caution:
The functions and solutions described in this entry are mainly limited to the
realization of the automation task. In addition, please note that suitable security
measures in compliance with the applicable Industrial Security standards must be
taken if your system is interconnected with other parts of the plant, the company's
network or the Internet. More information can be found under entry ID 50203404.
http://support.automation.siemens.com/WW/view/en/50203404
If you have any questions about this document, please contact us at the following
e-mail address:
[email protected]
Copyright Siemens AG 2013 All rights reserved
Configuration Examples 4
SIMATIC Further Points to
SIMATIC S7-400H configurations consider 5
with PROFINET
Links & Literature 6
History 7
Copyright Siemens AG 2013 All rights reserved
Note The application examples are not binding and do not claim to be complete
regarding configuration, equipment and any eventuality. The application
examples do not represent customer-specific solutions. They are only intended
to provide support for typical applications. You are responsible for ensuring that
the described products are used correctly. These application examples do not
relieve you of your responsibility to use sound practices in application,
installation, operation and maintenance. When using these application examples,
you recognize that we will not be liable for any damage/claims beyond the
liability clause described. We reserve the right to make changes to these
application examples at any time without prior notice. If there are any deviations
between the recommendations provided in this application example and other
Siemens publications (e.g. catalogs), the contents of the other documents shall
have priority.
We do not accept any liability for the information contained in this document.
Any claims against us - based on whatever legal reason - resulting from the use of
the examples, information, programs, engineering and performance data etc.,
described in this application example shall be excluded. Such an exclusion shall
not apply in the case of mandatory liability, e.g. under the German Product Liability
Copyright Siemens AG 2013 All rights reserved
Table of Contents
Warranty and Liability ................................................................................................. 4
Table of Contents ......................................................................................................... 5
1 Introduction ........................................................................................................ 6
2 System and Media Redundancy....................................................................... 7
3 Functionalities of the H-CPUs as of V6.0 ........................................................ 9
4 Configuration Examples ................................................................................. 10
4.1 Communication between H system and field level via
PROFINET ......................................................................................... 11
4.1.1 Standard configuration “open ring” ..................................................... 11
4.1.2 Star-connected PN devices at the MRP ring...................................... 13
4.1.3 Star-connected PN devices at the MRP ring in the ring feed............. 16
4.1.4 MRP ring for distance bridging and in the subordinate ring ............... 19
4.1.5 Increasing the availability when using an H-CPU as single
controller ............................................................................................. 22
4.1.6 Switched PN devices via a switch integrated in the “open ring”
and as single I/O via the same switch in star topology ...................... 23
4.2 Communication between H-CPU and plant PCs ............................... 26
4.2.1 PC connection to an H system via a single ring ................................. 27
4.2.2 PC connection to two H systems via a single ring ............................. 28
Copyright Siemens AG 2013 All rights reserved
1 Introduction
Purpose of this document
The topic of “fault tolerance” comprises a number of application options, including
the field level as well as the connection to the plant PCs.
As of V6.0 for the H-CPUs, PROFINET can now also be used as field bus.
This opens a number of connection possibilities, varying more or less regarding
complexity and application case.
The document on hand shows a number of such connection options; for the field
level, for the connection of plant PCs to the H-controllers, and for the combination
ob both.
This gives you an overview of the configurations which can be realized with
PROFINET. Additional notes on advantages and selection criteria complete the
statements made in order to support you in planning the application of an H-CPU
or an H system.
PROFIBUS/PROFINET
This document focuses on configurations with PROFINET. All previous statements
on configurations with PROFIBUS remain valid independent of PROFINET.
PROFIBUS and PROFINET have no mutual impact on each other.
Copyright Siemens AG 2013 All rights reserved
Required knowledge
Understanding this document requires
• general SIMATIC knowledge
• basic knowledge on H systems
• basic knowledge on the PROFINET communication standard
The terms “system redundancy” and “media redundancy”, frequently used in this
document, are explained in the chapters below.
Usable H-CPUs
All statements in this document refer to H-CPUs as of version 6.0.
System redundancy
Requirement for realizing the system redundancy is the application of an H system.
The H system consists of two fault-tolerant controllers (master and reserve CPU). If
one H-CPU fails, the other automatically takes over.
System redundancy is a connection of IO devices via PROFINET
(PN devices), for which there is a communication connection between each PN
device and each of both H-CPUs (see picture below).
H system
Copyright Siemens AG 2013 All rights reserved
PN devices
The IO devices need to support the system redundancy; otherwise, they can be
operated in the same network, however only one of both H-CPUs can be assigned
(unilateral periphery).
The used topology (line, star, ring) plays no role for the system redundancy. This
distinguishes the system redundancy from the media redundancy.
System redundant periphery is often also referred to as switched I/O. This does
not refer to the fault tolerance between I/O groups or systems.
An example for switched I/O (system-redundant I/O) are PN devices, which support
the system redundancy and can be assigned to an H system (e.g. ET 200M). In
contrast, the ET 200S, for example, can only be assigned to an H-CPU unilaterally
(no H system).
Media redundancy
Media redundancy ensures the network availability and contributes to increasing
the plant availability.
The ring topology is used here. The media redundancy protocol (MRP) ensures
that when one transmission path fails, an alternative communication path is
available.
The nodes with PROFINET interface interconnected in the ring use MRP as of
V6.0, if MRP-capable. MRP is part of the PROFINET standardization according to
IEC 61158.
For media redundancy with MRP, one device is the media redundancy manager
(MRM), all other devices are redundancy clients. In the picture below, the CPU is
the MRP-Manager.
In the case of a failed connection, the MRM selects the alternative communication
path.
CPU
Copyright Siemens AG 2013 All rights reserved
PN devices
Ring
Context
System and media redundancy have no mutual impact on each other.
Synchronization module
• New synchronization modules, however, cables as before (connector of HF-
Sync interfaces is compatible with the previous one)
• Color coded local and remote coupling at the locking clamp.
– black refers to local coupling (6ES7 960–1AA06–0XA0)
– blue refers to remote coupling (6ES7 960–1AB06–0XA0)
• Furthermore, exchange under voltage possible
• Additional diagnosis of synchronization modules (temperature, aging, …)
PROFINET interface
• User data transfer
– In the H system, a maximum of 256 PN devices is supported at both
integrated PN interfaces. It does not matter whether these can be
configured unilateral or switched.
Copyright Siemens AG 2013 All rights reserved
Note The connection of an external IO controller (CP) is not supported in V6.0 of the
H-CPU.
Master/reserve changeover
The master/reserve changeover (MRU) can also be programmed (SFC 90
“H-CTRL”).
4 Configuration Examples
What will you learn here?
In this chapter you find configuration options for operating a single H-CPU or an H
system in PROFINET networks.
For better clarity, the connection with the field level and the connection with the
plant PCs are initially displayed separately. Subsequently, possible combinations of
both connection options are displayed.
The chapter on hand is divided into the following sub-chapters:
This chapter provides you with an overview on the possible H configurations and
when to replace the CP 443-1 with the internal PN interface.
Copyright Siemens AG 2013 All rights reserved
Description
The picture below shows a system-redundant connection in a so-called open ring.
Copyright Siemens AG 2013 All rights reserved
H system
PN devices
For the open ring, the PN devices are set up as single channel. After the H system
has gone from single operation to redundant system state, both H-CPUs process
the same program in synchronism. However, process data are only exchanged
with the PN device by one H-CPU.
The function of the controller remains at the following faults:
• failed master CPU, since the reserve CPU automatically takes over.
• failed I/O station
• wire break
For I/O station failure or wire break, the respectively accessible I/O stations are
controlled by both H-CPUs (advantage over a non-H system).
Failure scenarios
The picture below shows a media failure due to wire break as a failure scenario
example.
Master CPU
Reserve CPU
PN device
communicates with
reserve CPU
PN device communicates
with master CPU
Copyright Siemens AG 2013 All rights reserved
Description
The subsequent picture shows the application of an H system for controlling PN
devices of the field level. The PN devices are connected at the MRP ring in star
topology
Ring topology:
H system
fibre-optics or electrical
SCALANCE
switches
PN devices
(field level)
Copyright Siemens AG 2013 All rights reserved
In this configuration, the system as well as the media redundancy can become
effective:
system redundancy is enabled by using an H system.
The system redundancy is supplemented by media redundancy which is achieved
by a ring-interconnection of the (external) SCALANCE switches.
Combining media and system redundancy can compensate an additional error
(failure of an H-CPU) on top of a media failure.
System and media redundancy have no mutual impact on each other.
All ring nodes must be compatible with the media redundancy protocol (MRP). The
hardware components that can be used as media redundancy manager (MRM) are
available in the following entry:
http://support.automation.siemens.com/WW/view/en/23498599
MR Manager MR Manager
The master CPU exchanges process data with the PN devices (left picture).
When a connection fails (media failure) within the ring (right picture) the MR
Copyright Siemens AG 2013 All rights reserved
The process is maintained bumpless by means of the reserve CPU. The media
redundancy is not required for the failure scenario.
MR Manager
MR Manager
The availability remains due to the media and system redundancy. Despite of the
Copyright Siemens AG 2013 All rights reserved
failure of the master CPU and the failure of a ring-connection, the demanded
functionality is maintained.
Description
The picture below shows the application of an H system for controlling PN devices
of the field level. The PN devices are connected at a MRP ring in star topology
In contrast to chapter 4.1.2, there is additional periphery here between the H-CPUs
and the MRP ring.
Ring topology:
H system fibre optics or electrical
Additional I/O
PN devices
SCALANCE
switches
PN devices
(field level)
Copyright Siemens AG 2013 All rights reserved
Open ring
MRP ring
All ring nodes must be compatible with the media redundancy protocol (MRP). The
hardware components that can be used as media redundancy manager (MRM) are
available in the following entry:
http://support.automation.siemens.com/WW/view/en/23498599
When the master CPU and/or the connection from the master CPU fails, the overall
system can tolerate a further media failure in the MRP ring. It is irrelevant here at
which point the MPR ring is disconnected.
For this scenario, which shows a combination of system and media redundancy, all
intact connections for the exchange of process data are not necessary.
Generally the following applies: in the system states single operation, link-up or
update for the S7-400H, the connections between the PN devices in the ring feed
and the MRP ring must exist (see next picture). A failure of these connections in
the so-called system states cannot be compensated regarding the overall
availability.
These connections
must be available
4.1.4 MRP ring for distance bridging and in the subordinate ring
Description
The picture below shows the application of an H system for controlling the switched
PN devices within a subordinate MPR ring of the field level.
H system
Ring version:
fibre-optics or
electrical
MRP rings
SCALANCE
switches
SCALANCE
switches
Copyright Siemens AG 2013 All rights reserved
Failure scenario 1: media failure in the upper and lower MRP ring
The picture below shows which further failures can still be compensated by the
overall system after a CPU failure.
MRP rings
Copyright Siemens AG 2013 All rights reserved
MRP ring
In addition to the failure of the master CPU, the following can fail in the line in
which process data is exchanged:
• any connection in the upper MRP ring and
• any connection in the lower MRP ring.
MRP rings
MRP ring
Copyright Siemens AG 2013 All rights reserved
Failure scenario 3: failure of a SCALANCE switch in the upper and subordinate MRP ring
When a SCALANCE switch fails in the upper and in the subordinate MRP ring, it is
important regarding the overall availability which SCALANCE switches fail.
When an H-CPU (IO controller) fails, the entire process periphery is no longer
available due to missing system redundancy.
When a PN device fails, the functionality of the redundant PN device can only be
maintained if the subordinate of both PN devices in the line fails. If the upper PN
Copyright Siemens AG 2013 All rights reserved
PN devices
4.1.6 Switched PN devices via a switch integrated in the “open ring” and as
single I/O via the same switch in star topology
Description
The picture below shows a PN IO configuration for which the periphery is
connected to an H system via open ring and SCALANCE switch. Additionally,
individual PN devices are connected via a star configuration.
Both H-CPUs (IO controller) each communicate via the internal PROFINET
interface with the respective redundant assigned PN devices.
H system
SCALANCE
switch
Copyright Siemens AG 2013 All rights reserved
PN devices
In this example, the central PN switch connected in star topology fails. The
availability of the lower PN switch could be increased by connecting it directly to
the SCALANCE switch instead of the central PN device.
Otherwise, the following applies: for a connection failure of the PN devices
connected in star topology, the PN device connected at the failed connection fails.
The PN devices of the open ring remain unaffected and are still available.
Description
The picture below shows the application of an H system for communication with the
plant PCs. Communication with an H system is performed via a single ring.
Plant PCs
H system
Copyright Siemens AG 2013 All rights reserved
PC interface
As CP for the plant PC, the CP 1613, CP 1613 A2, CP 1623 or CP 1628 can be
used (software package "S7-REDCONNECT" required).
For changing from CP 1613 A2 to CP 1623, certain requirements must be fulfilled.
These are discussed in entry below.
http://support.automation.siemens.com/WW/view/en/50710358
Description
The figure below shows an expansion of the alignment from chapter 4.2.1, Instead
of with one, the plant PCs communicate with two H systems. The connection for
the communication is also handled via a single ring.
Plant PCs
H systems
Copyright Siemens AG 2013 All rights reserved
PC interface
As CP for the plant PC, the CP 1613, CP 1613 A2, CP 1623 or CP 1628 can be
used (software package "S7-REDCONNECT" required).
For changing from CP 1613 A2 to CP 1623, certain requirements must be fulfilled.
These are discussed in entry below.
http://support.automation.siemens.com/WW/view/en/50710358
Description
The picture below shows the application of an H system for communication with the
plant PCs.
Plant PCs
SCALANCE
switch Star point
H system
Copyright Siemens AG 2013 All rights reserved
Additionally, a second SCALANCE switch (as in chapter 4.2.1 and 4.2.2) can be
integrated. The higher procurement costs are countered by the option of reaching
media redundancy across larger distances (e.g. up to 26 km with SCALANCE X-
200).
PC interface
As CP for the plant PC, the CP 1613, CP 1613 A2, CP 1623 or CP 1628 can be
used (software package "S7-REDCONNECT" required).
For changing from CP 1613 A2 to CP 1623, certain requirements must be fulfilled.
These are discussed in entry below.
http://support.automation.siemens.com/WW/view/en/50710358
Description
The picture below shows the application of two H system for communication with
plant PCs of redundant design.
Each PC is directed to both H systems via line topology.
Plant PCs
SCALANCE
switches
Copyright Siemens AG 2013 All rights reserved
H systems
PC interface
As CP for the plant PC, the CP 1613, CP 1613 A2, CP 1623 or CP 1628 can be
used (software package "S7-REDCONNECT" required).
For changing from CP 1613 A2 to CP 1623, certain requirements must be fulfilled.
These are discussed in entry below.
http://support.automation.siemens.com/WW/view/en/50710358
Increased availability
Optionally, both SCALANCE switches can also be interconnected to increase the
availability, if desired and achievable.
Description
The picture below shows redundant plant PCs, with each PC having two CPs. The
redundant communication connection is achieved via the double ring.
Two CPs are also assigned to each H-CPU of the H system (high degree of
availability).
Plant PCs
CP1 CP2
CP1 CP2
SCALANCE Double-ring
switches Ring version:
fibre-optics or
electrical
Copyright Siemens AG 2013 All rights reserved
H system
CP1 CP1
CP2 CP2
PC interface
As CP for the plant PC, the CP 1613, CP 1613 A2, CP 1623 or CP 1628 can be
used (software package "S7-REDCONNECT" required).
For changing from CP 1613 A2 to CP 1623, certain requirements must be fulfilled.
These are discussed in entry below.
http://support.automation.siemens.com/WW/view/en/50710358
Plant PCs
CP1 CP2
CP1 CP2
SCALANCE Double-ring
switches Ring 1
Ring version:
fibre-optical or
electrical
Ring 2
Copyright Siemens AG 2013 All rights reserved
H system
CP1 CP1
CP2 CP2
Each SCALANCE switch, however, must only work in one ring in order to
guarantee media redundancy.
Multiple rings can be avoided using CP 443-1 (instead of the internal PN interface).
The picture below shows the usage of the CP 443-1 (PC connection) and the PN
interface (subordinate field level).
Plant PCs
SCALANCE
switches
SCALANCE MRP
switches
PN devices
Copyright Siemens AG 2013 All rights reserved
The SCALANCE switches above the H system for connecting the plant PCs are
used for bridging the distance and can use the MRP (not mandatory). There are
several possibilities of a redundancy mechanism for bridging occurring failures,
such as
• High Speed Redundancy (HSR)
• Spanning Tree (SPT)
• Rapid Spanning Tree (RSPT)
The CP 443-1 can in this configuration not be replaced by the internal PN interface,
since this produces multiple rings (see picture below).
Plant PCs
SCALANCE
switches Ring 1
This SCALANCE
switch is located
Ring 2
in 3 rings!
H system Ring 3 Fibre-optical ring
I/O connected at
MRP ring
SCALANCE MRP
switches
PN devices
The picture below shows the usage of the CP 443-1 (PC connection) and the PN
interface (subordinate field level).
Plant PCs
SCALANCE
switches
CP CP
H system
Copyright Siemens AG 2013 All rights reserved
PN devices
The SCALANCE switch is not integrated in any ring. If the CPs 443-1 are replaced
by the PN interface, a ring is produced (next picture). For this configuration, the CP
443-1 can be replaced by the PN interface.
Plant PCs
SCALANCE
switches
H system Ring
PN devices
The picture below shows the usage of the CP 443-1 (PC connection) and the PN
interface (subordinate field level).
Plant PCs
SCALANCE
switches
Communication via CP
H systems
Communication via integrated
PROFINET interface
PN devices
Copyright Siemens AG 2013 All rights reserved
Each SCALANCE switch is located in a ring. If the CPs 443-1 are replaced by the
PN interface, a total of three rings is produced (next picture). For this configuration,
the CP 443-1 cannot be replaced by the PN interface.
Plant PCs
H systems
PN devices
Rings 2 and 3 are not located within the open ring between PN device and
H system (compare chapter 4.1.3, where the SCALANCE switch is located within
an open ring which is not counted as a ring).
The picture below shows the usage of the CP 443-1 (PC connection) and the PN
interface (subordinate field level).
Plant PCs
SCALANCE
switches
H system
Copyright Siemens AG 2013 All rights reserved
PN devices
CP or PN interface?
The decision for or against an external CP or the internal PN interface at the
H-CPU depends on various considerations.
The decision always stretches across the overall consideration of the network.
Multiple rings for the SCALANCE switches must not be created.
When using the internal PN interface, the H-CPU, for example, can be integrated
into a ring. Furthermore, there are no more costs for the CP 443-1.
On the other hand, the CP 443-1 gives you the option of setting up additional
communication paths. A slot reservation should always be planned for the PC
connection.
For the topic of redundancy, the common cause failure must always be taken into
account. It is switched before and in line with the redundancy, i.e. an error affects
all successive redundant equipment which cuts off the availability.
An example noted here are tripping hazards as common case failure at the plant
PCs. In such a case, both PC cards would be affected, which would cut off the
availability.
MTBF
The application of redundant modules strongly increases the MTBF (Mean Time
Between Failure) of a system. The MTBF specifies the average operating time
between two failures and is therefore a measure of the reliability of a module or a
system.
The MTBF can either be statistically determined via system which are in operation,
or be calculated via the failure rates of the employed components.
MTBF values for SIMATIC components are given together with further explanations
on the MTBF under the following link:
http://support.automation.siemens.com/WW/view/en/16818490
Internet Links
The following list is by no means complete and only provides a selection of
appropriate information.
Table 6-2
Copyright Siemens AG 2013 All rights reserved
Topic Title
\1\ Link to this http://support.automation.siemens.com/WW/view/en/entryID
document
\2\ Siemens Industry http://support.automation.siemens.com
Online Support
\3\ System Manual http://support.automation.siemens.com/WW/view/en/60458386
S7-400H
7 History
Version Date Revisions
V1.0 01/2013 First issue
V1.1 01/2013 Changed picture in chapter 2