High-availability communication

With high-availability communication SIMATIC offers a type of communication with the following features:

• Increased availability:
  In the event of a fault, communication can be continued via up to 4 redundant connections. The necessary switchover goes unnoticed by the user.
• Simple operation;
  high-availability is invisible from the user's perspective. User programs for standard communication can be adopted without changes. The redundancy function is defined only at the parameterization stage.

High-availability communication is currently supported by the S7-400H (redundant and non-redundant configuration) and by PCs. On PCs, the Redconnect program package is required (see "SIMATIC NET communication systems").

Depending on availability requirements, different configuration options can be used:

• Single or redundant bus.
• Bus in linear or ring topology.

Functional principles

The operating system of the CPU 417-5H, CPU 416-5H, CPU 414-5H and CPU 412-5H executes all the necessary additional functions of the S7-400H autonomously:

• Data exchange
• Fault response (failover to standby device)
• Synchronization of both subunits
• Self-test

Redundancy principle

The S7-400H works according to the principle of active redundancy in "hot standby" mode (reaction-free automatic switchover in the event of a fault). According to this principle, both subunits are active during fault-free operation. In the event of a fault, the intact device assumes control of the process alone.

To guarantee this transfer bumplessly, fast and reliable data exchange via the central controller link is required.

In the course of the failover, the devices automatically retain

• the same user program
• the same data blocks
• the same process image contents
• the same internal data such as timers, counters, bit memories, etc.

This means both devices are always completely up-to-date and can continue control alone in the event of a fault.

For redundant operation of the I/O this results in the following:

• During fault-free operation, both modules are active, that is, in the case of redundant inputs, for example, the shared sensor (two sensors are also possible) is read in via two modules, and the results are compared and made available to the user as a unified value for further processing. In the case of redundant outputs, the value calculated by the user program is output by both modules.
• In the event of a fault, e.g. the failure of one or both of the input modules, the defective module is no longer addressed, the fault is reported, and operation continues with the intact module only. Following the repair, which can take place online, both modules are addressed again.

Synchronization

For reaction-free switchover, synchronization of both subunits is necessary.

The S7-400H works with "event-driven synchronization".

This involves a synchronization operation whenever events could result in different internal states in the subunits, e.g. in the case of

• Direct access to the I/O
• Interrupts, alarms
• Updating of the user times or
• Modification of data by means of communication functions.

The synchronization takes place automatically by means of the operating system and can be ignored at the programming stage.

Self-test

The S7-400H executes extensive self-tests. This involves testing the following:

• Connection of the central controllers.
• CPUs.
• Processor/ASIC.
• Memory.

Every detected fault is reported.

Self-test at startup

At startup, each subunit executes all self-test functions completely.

Self-test in cyclic operation

The complete self-test is spread over several cycles. A short section of the self-test is executed per cycle so that the load on the actual controller is insignificant.

Configuring, programming

The S7-400H is programmed like an S7-400. All the STEP 7 functions available there can be used.

Programming the S7-400H with PROFINET requires STEP 7 V5.5 with SP2.

Configuring of I/O modules

When configuring the hardware, users must specify via HW Config which modules are mutually redundant. This only requires the specification of the modules to be operated in redundant mode and the second module that is to be the "redundancy partner". In the user program, the module with the lowest address is to be accessed. The second address remains hidden from the user and programming of the control section with redundant and non-redundant I/O is identical. The only difference with regard non-redundant I/O are two FBs (RED_IN and RED_OUT) from the block library that are to be called at the start and at the end of the user program.

In STEP 7 V5.3 or higher, the library is integrated as standard into STEP 7.