Engineering System - Siemens Automation and Drives Group

10
Automation systems
Fault-tolerant automation systems
■ Overview
Fault-tolerant automation systems are used to minimize the risk
of production failures. The higher investment in fault-tolerant automation
systems is often negligible compared to the costs resulting
from production stoppages. The higher the costs resulting
from loss of production, the more important a fault-tolerant
system becomes.
■ Design
The AS 414-4-1H and AS 417-4-1H automation systems are initially
equipped with just one CPU. They are used in particular
when the redundant subsystems have to be physically separated
from one another for safety reasons or when the customer
would like to keep open his options for a redundant configuration
in the future. The failsafe AS 414F and AS 417F automation systems
are based likewise on this hardware in the corresponding
version.
There are two configuration possibilities for the AS 414-4-1H and
AS 417-4-1H automation systems:
Configuration with two standard subracks (UR1 or UR2)
This configuration is ideal when the two redundant subsystems
have to be completely separated for availability reasons.
Each subsystem contains a CPU, a potentially redundant
power supply module (AC), and a communication
module for Industrial Ethernet.
Configuration with a UR2-H subrack
The UR2-H compact subrack with split backplane bus is suitable
for configuring a complete fault-tolerant automation system.
For the AS 414-4-1H and AS 417-4-1H the UR2-H is
equipped with a CPU, a potentially redundant power supply
module and a communications module for Industrial Ethernet.
In the case of the redundant AS 414-4-2H and AS 417-4-2H automation
systems, the two subsystems are accommodated in
the UR2-H subrack. Each subsystem is equipped with a CPU, a
potentially redundant power supply module and a communications
module for Industrial Ethernet.
In all the configurations described, potentially redundant power
supply modules can be expanded to redundant configuration by
retrofitting a second power supply module of the same type.
Another 4 sync modules and 2 sync cables have to be ordered
in addition to create a redundant system from two AS 414-4-1H
or AS 417-4-1H automation system (UR1/UR2 subracks) and to
subsequently expand an AS 414-4-1H or AS 417-4-1H in a UR2-
H subrack into a redundant AS 414-4-2H or AS 417-4-2H system.
10/6
Siemens ST PCS 7 · October 2004
Connection of process I/Os
Several PROFIBUS DP lines with distributed process I/Os can be
operated on each sub-AS through the internal PROFIBUS DP interface
or by using additional communications processors.
The distributed ET 200M I/Os are connected through two
IM 153-2 interface modules on a special bus module to two redundant
PROFIBUS DP lines, and the intelligent field devices on
the PROFIBUS PA are connected through a redundant
DP/PA link with two IM 157 interface modules. The Y-link can
also be used to connect non-redundant PROFIBUS DP devices
to the redundant PROFIBUS DP.
A mixture of these configurations is also possible.
Communication through the plant bus
The redundant, fault-tolerant AS 414H and AS 417H automation
systems are connected by one communication module per sub-
AS to the plant bus. The plant bus can be implemented in the
form of a ring structure, which can also be configured with redundant
architecture if the availability requirements are high.
When there are two redundant rings it makes sense to use two
communication module per sub-AS and to distribute their connections
between the two rings. Double faults such as OSM failure
on ring 1 with simultaneous splitting of the bus cable on ring
2 can thus be tolerated.
■ Function
The AS 414H and AS 417H models are the fault-tolerant automation
systems for use with SIMATIC PCS 7. They are based on the
1-out-of-2 principle and switch to the backup system in the event
of a fault. These systems use a completely redundant design to
maximize availability. This means that all major components
such as CPU, power supply and hardware for coupling the two
CPUs are present in pairs. Which other components are also
made available in pairs in the interest of availability depends on
the particular automation task.
The two subsystems of a redundant automation system are electrically
isolated from one another. This increases the system stability
with respect to EMC interference. A redundant automation
system can be installed mechanically in a one- or two-rack architecture.
Automation systems are installed in two racks, for example,
if the two parts of the automation system have to be physically
separated from one another by a fire-resistant wall.
Appropriate complete units are available for every type of application.
Mixed operation of redundant and standard systems is
also possible.