Premium: Hot Standby With Unity User Manual
Premium: Hot Standby With Unity User Manual
35012068 04/2015
Premium
Hot Standby with Unity
User Manual
04/2015
35012068.12
www.schneider-electric.com
The information provided in this documentation contains general descriptions and/or technical
characteristics of the performance of the products contained herein. This documentation is not
intended as a substitute for and is not to be used for determining suitability or reliability of these
products for specific user applications. It is the duty of any such user or integrator to perform the
appropriate and complete risk analysis, evaluation and testing of the products with respect to the
relevant specific application or use thereof. Neither Schneider Electric nor any of its affiliates or
subsidiaries shall be responsible or liable for misuse of the information contained herein. If you
have any suggestions for improvements or amendments or have found errors in this publication,
please notify us.
No part of this document may be reproduced in any form or by any means, electronic or
mechanical, including photocopying, without express written permission of Schneider Electric.
All pertinent state, regional, and local safety regulations must be observed when installing and
using this product. For reasons of safety and to help ensure compliance with documented system
data, only the manufacturer should perform repairs to components.
When devices are used for applications with technical safety requirements, the relevant
instructions must be followed.
Failure to use Schneider Electric software or approved software with our hardware products may
result in injury, harm, or improper operating results.
Failure to observe this information can result in injury or equipment damage.
© 2015 Schneider Electric. All rights reserved.
2 35012068 04/2015
Table of Contents
Safety Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
About the Book. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Part I Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 1 Hot Standby Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Purpose and Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Redundant Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Core Hot Standby Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Configuration Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Establishing Redundancy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Revised Operation Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Programming Differences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Hot Standby Restricted Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Chapter 2 Hot Standby Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Introduction to the Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Operating Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Certifications and Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Chapter 3 Hot Standby Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.1 Minimum Configurations by I/O Type . . . . . . . . . . . . . . . . . . . . . . . . . 56
Minimum Configuration for Redundant Discrete I/O . . . . . . . . . . . . . . 57
Minimum Configuration for Redundant Analog I/O (Inputs Only) . . . . 60
Minimum Configuration for Redundant Analog I/O (Outputs Only) . . . 62
Minimum Configuration for Ethernet I/O . . . . . . . . . . . . . . . . . . . . . . . 66
Minimum Configuration for Redundant Modbus I/O . . . . . . . . . . . . . . 71
Adding HMI / SCADA to the ETY-sync link . . . . . . . . . . . . . . . . . . . . . 76
3.2 Compatible Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Premium Racks and Rack Accessories. . . . . . . . . . . . . . . . . . . . . . . . 81
Premium Power Supplies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
In-rack Communication Modules: Ethernet . . . . . . . . . . . . . . . . . . . . . 83
In-rack Communication Modules: Modbus . . . . . . . . . . . . . . . . . . . . . 84
In-rack I/O Modules: Discrete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
In-rack I/O Modules: Analog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
In-rack I/O Modules: Safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
35012068 04/2015 3
Connection Devices: Discrete I/O . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Connection Devices: Main Rack Analog I/O . . . . . . . . . . . . . . . . . . . . 89
Allowed Devices: Connected by Ethernet . . . . . . . . . . . . . . . . . . . . . . 90
Allowed Devices: Connected by Modbus. . . . . . . . . . . . . . . . . . . . . . . 91
Ethernet Network Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Modbus Network Devices and Cables . . . . . . . . . . . . . . . . . . . . . . . . . 93
Maximum Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
3.3 Example Hot Standby Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
System with Multiple ETYs Running I/O Scanning Services . . . . . . . . 98
System with Redundant I/O and SCADA Network Services . . . . . . . . 100
System with Mixed Ethernet and Modbus . . . . . . . . . . . . . . . . . . . . . . 102
Chapter 4 PLC Communications and Switchover . . . . . . . . . . . . 103
4.1 Database Transfer Between Hot Standby PLCs . . . . . . . . . . . . . . . . . 104
Understanding the Premium Hot Standby Database Transfer Process 105
Understanding System Scan Time in Premium Hot Standby. . . . . . . . 107
Chapter 5 Switchover and Swap in Premium Hot Standby . . . . . 111
Ethernet Service Switchover Latencies . . . . . . . . . . . . . . . . . . . . . . . . 112
In-rack I/O Switchover Latencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Presentation for Swapping in Premium Hot Standby . . . . . . . . . . . . . . 114
Operating recommendations for Swapping in a Premium Hot Standby
system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Chapter 6 Compatibility with PL7 Systems . . . . . . . . . . . . . . . . . . 119
Considerations When Upgrading From PL7 . . . . . . . . . . . . . . . . . . . . 120
Using the PL7-Unity Pro Converter . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
Part II Configuration and Use . . . . . . . . . . . . . . . . . . . . . 123
Chapter 7 Configuring in Unity Pro . . . . . . . . . . . . . . . . . . . . . . . . 125
7.1 Configuring a System with the Unity Pro Tabs and Dialogs. . . . . . . . . 126
Introducing Unity Pro . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127
Accessing the Base Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
Using the Overview Tab. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Using the Configuration Tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Using the Animation Tab and PLC Screen Dialogs . . . . . . . . . . . . . . . 132
Using the Premium Hot Standby Tab. . . . . . . . . . . . . . . . . . . . . . . . . . 138
Configuring In-rack I/O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
Configuring the PCMCIA Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140
Swapping Network Addresses at Switchover. . . . . . . . . . . . . . . . . . . . 142
4 35012068 04/2015
7.2 Configuring TSX ETY 4103/5103 Modules . . . . . . . . . . . . . . . . . . . . . 146
Overview of Premium Hot Standby TSX ETY . . . . . . . . . . . . . . . . . . . 147
ETY Operating Modes and Premium Hot Standby . . . . . . . . . . . . . . . 150
IP Address Assignment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
Network Effects of Premium Hot Standby . . . . . . . . . . . . . . . . . . . . . . 155
7.3 Configuring Registers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Understanding System Words and Bits . . . . . . . . . . . . . . . . . . . . . . . . 159
Understanding the Non-Transfer Area and Reverse Transfer Words . 160
Understanding the Unity Command Register . . . . . . . . . . . . . . . . . . . 161
Understanding the Unity Status Register . . . . . . . . . . . . . . . . . . . . . . 163
Using Initialized Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
Synchronization of Realtime Clocks . . . . . . . . . . . . . . . . . . . . . . . . . . 167
Chapter 8 Programming/Debugging . . . . . . . . . . . . . . . . . . . . . . . 169
8.1 Developing Your Hot Standby Application. . . . . . . . . . . . . . . . . . . . . . 170
Programming Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
How to Program a Premium Hot Standby Application . . . . . . . . . . . . 176
Structure of Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
Transferring Your Program to the Primary and Standby PLCs . . . . . . 185
8.2 Debugging Your Hot Standby Application . . . . . . . . . . . . . . . . . . . . . . 186
Debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Adjusting MAST Task Properties. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
Using the Hotstandby system with the HSBY_SWAP DFB . . . . . . . . . 194
Chapter 9 Operating. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
9.1 Start/Stop System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
Starting the Two PLCs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Stopping the Premium Hot Standby . . . . . . . . . . . . . . . . . . . . . . . . . . 203
9.2 Switchover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
Operating Modes Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
Conditions for Switchover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Chapter 10 Maintaining . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Verifying the Health of a Premium Hot Standby . . . . . . . . . . . . . . . . . 214
Premium Hot Standby Detection and Diagnostics. . . . . . . . . . . . . . . . 215
Detecting Inoperative Primary CPU- and ETY-sync Links . . . . . . . . . 217
Detecting Inoperative Standby CPU- and ETY-sync Links . . . . . . . . . 218
Detecting Inoperative CPU-sync Links . . . . . . . . . . . . . . . . . . . . . . . . 219
Checking for Identical Application Programs—Checksum . . . . . . . . . 220
Replacing an Inoperative Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
Troubleshooting a Hot Standby PLC . . . . . . . . . . . . . . . . . . . . . . . . . . 223
35012068 04/2015 5
Part III Modifying and Upgrading . . . . . . . . . . . . . . . . . . . 225
Chapter 11 Handling Application Modification . . . . . . . . . . . . . . . . 227
Understanding Premium Hot Standby Logic Mismatch . . . . . . . . . . . . 228
Online/Offline Modifications to an Application Program . . . . . . . . . . . . 229
Chapter 12 Handling PLC Firmware Upgrades . . . . . . . . . . . . . . . . 235
Overview of Premium Hot Standby Firmware Upgrades . . . . . . . . . . . 236
Executing the Firmware Upgrade Procedure . . . . . . . . . . . . . . . . . . . . 237
Appendices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
Appendix A Additional Information . . . . . . . . . . . . . . . . . . . . . . . . . . 241
Additional Premium Hot Standby Specifications . . . . . . . . . . . . . . . . . 242
TextIDs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
Appendix B Detailed Behavior on Interruption of Power,
Communications, or Device Capabilities. . . . . . . . . . . 251
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
Halt Events or Stop Command on PLC . . . . . . . . . . . . . . . . . . . . . . . . 254
CPU Hardware or Firmware Becomes Inoperative . . . . . . . . . . . . . . . 257
Interruption of Supply Power to Main Rack . . . . . . . . . . . . . . . . . . . . . 260
ETY Hardware or Firmware (Monitored by Hot Standby CPU)
Becomes Inoperative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
ETY Hardware or Firmware (Not Monitored by Hot Standby CPU)
Becomes Inoperative . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
Ethernet Copro Becomes Inoperative . . . . . . . . . . . . . . . . . . . . . . . . . 269
Interruption of CPU-sync link between Primary and Standby PLCs . . 272
ETY-sync Link Cable Disconnection with I/O Scanner Active . . . . . . . 274
Full ETY I/O Link Disconnection (Both Switches for Monitored I/O
Inoperative) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
Discrete I/O Module Becomes Inoperative. . . . . . . . . . . . . . . . . . . . . . 280
SCP Card in SCY Module Becomes Inoperative . . . . . . . . . . . . . . . . . 283
Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289
6 35012068 04/2015
Safety Information
Important Information
NOTICE
Read these instructions carefully, and look at the equipment to become familiar with the device
before trying to install, operate, or maintain it. The following special messages may appear
throughout this documentation or on the equipment to warn of potential hazards or to call attention
to information that clarifies or simplifies a procedure.
35012068 04/2015 7
PLEASE NOTE
Electrical equipment should be installed, operated, serviced, and maintained only by qualified
personnel. No responsibility is assumed by Schneider Electric for any consequences arising out of
the use of this material.
A qualified person is one who has skills and knowledge related to the construction and operation
of electrical equipment and its installation, and has received safety training to recognize and avoid
the hazards involved.
8 35012068 04/2015
About the Book
At a Glance
Document Scope
This manual presents information necessary to configure and operate your Premium Hot Standby
System consisting of the Premium Hot Standby processor (TSX H57 24M or TSX H57 44M) and
the Unity Pro software. It also discusses the implementation of redundant I/O consistent with the
Hot Standby system, including Discrete, Analog, and Ethernet I/O using the TSX ETY 4103 / 5103
modules. Finally, this manual provides information regarding device communication using Modbus
and other Premium Ethernet services, and places the Hot Standby in context of a larger distributed
system involving HMI / SCADA and remote network devices.
While this manual describes how to set up and configure a Premium Hot Standby System you have
already installed, it does not describe the basic physical installation of the Premium Hot Standby
CPU, rack, power supply, or associated hardware. Nor does it provide related information such as
operating limits, grounding, electromagnetic compatibility, or other environmental considerations.
For details on these topics, please refer to the Related Documents.
Validity Note
This documentation is valid for Unity Pro 10.0 or later.
Related Documents
You can download these technical publications and other technical information from our website
at www.schneider-electric.com.
35012068 04/2015 9
Product Related Information
DANGER
HAZARD OF ELECTRIC SHOCK, EXPLOSION or ARC FLASH
Be familiar with the power requirements of all devices and accessories being installed,
removed, or maintained in the Premium Hot Standby system.
Always use a properly rated voltage-sensing device to confirm that power is off.
Replace and secure all covers and elements of the system before reapplying power.
Confirm that all affected PLCs are loaded with the correct application program before
reapplying power.
Use only the specified voltage for your TSX PSY series power supply when placing the system
in operation.
Failure to follow these instructions will result in death or serious injury.
WARNING
UNEXPECTED SYSTEM BEHAVIOR - INVALID CONTROL PATHS
The designer of any control scheme must consider the potential failure modes of control paths.
He must provide a mean to achieve a safe state during and after a path failure for certain
critical control functions, for instance emergency stop and overtravel stop.
Separate or redundant control paths must be provided for critical control functions as well.
System control paths must include communication links. Consideration must be given to the
implications of unanticipated transmission delays or failures of the link.
Each implementation of a Premium processor-based system must be individually and
thoroughly tested for proper operation before being placed into service.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
The application of this product requires expertise in the design and programming of control
systems. Only persons with such expertise should be allowed to program, install, alter, and apply
this product.
Follow all local and national safety codes and standards.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
10 35012068 04/2015
Premium
Introduction
35012068 04/2015
Part I
Introduction
Introduction
35012068 04/2015 11
Introduction
12 35012068 04/2015
Premium
Hot Standby Concepts
35012068 04/2015
Chapter 1
Hot Standby Concepts
35012068 04/2015 13
Hot Standby Concepts
Terminology
14 35012068 04/2015
Hot Standby Concepts
Purpose
The Premium Hot Standby is an industrial control platform intended to provide automatic
redundancy for a wide range of conditions. It assists you in meeting your system availability
requirements at a reasonable cost. The main component of the system is a second PLC called the
"Standby" PLC with an identical configuration to the main or "Primary" controller.
By detecting and responding programmatically to defined system conditions, the Premium Hot
Standby can automatically transition from the Primary controller and its associated modules to the
Standby controller and its identical modules. This transition, called the "Switchover".
Because the Premium Hot Standby detects and responds automatically to a wide range of error
conditions, you will be able to reduce the length and complexity of your application programs. This
in turn enables quicker implementations and lower development and maintenance costs.
Features
The Premium Hot Standby system offers:
increases the system availability of your treatment plants and remote stations, allowing you to
conduct many maintenance operations while the system is operational
Reduces your installation and operating expenses
provides redundancy for I/O in the Premium racks and over Ethernet TCP/IP and Modbus
networks
requires no specialized modules or equipment other than the Hot Standby PLCs and Ethernet
(TSX ETY ···) modules. You can reuse your Premium racks, power supplies, and I/O (analog,
discrete).
offers a user-friendly development environment compatible with IEC 61131-3
allows creation of a redundant-ready application program almost as easily as for a standalone
PLC, and requires few changes from your normal programming methods
Hot Standby is a single-detected-fault-tolerant system. That is, the system continues operating
even when one component of the system is inoperative.
Use Restrictions
Monitored ETY modules (TSXETY4103/5103) are used in a Premium Hot Standby Multi-rack
system for managing communication between the two main racks.
35012068 04/2015 15
Hot Standby Concepts
WARNING
UNEXPECTED SYSTEM OPERATION
Do not use the following Ethernet services on Monitored ETY when using the Multi-rack function:
NTP
Messaging
SNMP
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Those services create overloads that can lead to malfunctions in the system and prevent the
system from delivering the expected availability and quality.
The Premium Hot Standby Multi-rack has been tested and validated against power cuts. It is able
to perform switchovers when power goes down on the rack where the Primary CPU is and is able
to withstand several consecutive power cuts (provided power comes back on the rack that was
powered off previously and the system restarts as Primary and Standby in a stable state, that is, a
minimum of one minute is provided after the system has successfully rebooted).
The Premium Hot Standby Multi-rack system has not been designed to stand repetitive and
frequent power cuts and may enter a state where the equipment under control is not managed (for
example, Primary Offline/Standby Offline states).
16 35012068 04/2015
Hot Standby Concepts
Overview
System Redundancy
The Premium Hot Standby controller implements system redundancy using redundant hardware
and by automatically switching over to the Standby (backup) hardware on detecting defined system
events. While your prior PLC experience is very important to the proper use of this system, you will
need to become familiar with new concepts, practices, and restrictions in order to properly
implement and manage the Premium Hot Standby’s redundancy. In this section, we present some
of the concepts that are most important to developing this familiarity. This section does not offer a
comprehensive discussion of these topics, but it should aid your understanding of this manual.
NOTE: Users of Premium PL7 systems should be aware that significant differences exist between
Unity- and PL7-based systems. There are further differences to be aware of if you are a Premium
PL7 Warm Standby user. Read and understand this manual before upgrading from a PL7 Warm
Standby system. See Compatibility with PL7 Systems (see page 119) for additional details.
NOTE: Users of Quantum Hot Standby and other redundant systems should be aware that
differences exist between the redundancy provided by these systems and that provided by the
Premium Hot Standby system. The differences include terminology, the conditions for switching to
the standby system, system requirements and restrictions, and more. Read and understand this
manual before implementing or installing your Premium Hot Standby system.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use the following for Ethernet communication between the Primary and Standby CPUs:
embedded CPU Ethernet ports
any active components, especially fiber optic converters
The embedded CPU Ethernet ports are dedicated to data exchange between Primary PLC and
Standby PLC. This is the “CPU Sync Link”.
Redundancy is possible at several levels in an architecture: SCADA Clients, Data Servers, Control
Network, PACs Station, Field Network, Field Devices, etc. Redundancy is used to enhance the
possibility that the services provided by the different parts continue to operate, generally without
loss of data, in case of interruption. It is possible to differentiate several levels of redundancy
according to their performances in terms of availability.
35012068 04/2015 17
Hot Standby Concepts
For more information about redundancy, please refer to the "System Technical Guide - High
Availability solutions" document available from Schneider-Electric, which provides detailed and
practical information about high availability systems.
WARNING
UNINTENDED EQUIPMENT OPERATION
Make an uninterrupted point-to-point connection between the Hot Standby CPU-sync link
ports.
Do not connect any other Ethernet devices (such as switches and hubs) so that they share the
same network cabling as the CPU-sync link.
Do not exceed maximum Ethernet cable lengths for the types of cable used.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Selection criteria for choosing between Modicon Premium and Modicon Quantum systems are
provided in the “PAC station” section of the “System Technical Guide - High Availability solutions”
available from Schneider-Electric.
There are many other criteria that can be part of the decision (including, but not limited to: cost,
performances and space), but the major technical differences are having Remote I/O redundancy
or I/O redundancy. Modicon Quantum systems are suitable for Remote I/O redundancy, whereas
Modicon Premium systems are the best solution for Local I/O redundancy.
There are other technical differences. For instance, some System Words (for example, %SW60
and %SW61) do not share the same mapping. Also, the Non-Transfer Area cannot be managed in
the same way, for more information, please refer to the "System Technical Guide - High Availability
solutions" document from Schneider-Electric.
18 35012068 04/2015
Hot Standby Concepts
Redundant Hardware
The role of the Primary PLC is almost identical to that of a single PLC in a non-Hot Standby system.
That is, it runs your application program and provides the normal control functions expected from
a standalone PLC.
The major differences from a standalone PLC are: (a) the Primary Hot Standby controller will
communicate regularly with its Standby PLC so that the Standby remains ready to assume the
Primary role if required, and; (b) the Primary PLC will monitor itself and certain associated
equipment for the specific conditions that dictate a Switchover to the Standby controller. In
addition, the Primary PLC manages all Redundant In-rack and Ethernet I/O.
However, there are two major differences from a standalone PLC:
The Primary PLC communicates regularly with the Standby PLC so that the Standby remains
ready to assume the Primary role if required.
The Primary PLC monitors itself and certain associated equipment for specific conditions that
dictate a switchover to the Standby controller. In addition, the Primary PLC manages all
redundant in-rack and Ethernet I/O.
The role of the Standby PLC is to assume control of the system but not to interfere with the control
asserted by the Primary controller. To do so, the Standby controller regularly monitors the state of
the redundant in-rack I/O and the distributed Ethernet I/O, which is being solved by the Primary
controller, and does not duplicate the I/O control signals sent by the Ethernet and Modbus modules
on the Primary rack. The Standby PLC may execute control logic for any local I/O that resides in
the same rack with it. The standby PLC solves only the first section (section 0) of the logic program;
it waits for and then applies the output images from the Primary controller to the I/O participating
in the Hot Standby application.
For a Premium HSBY multi-rack configuration, the following 2 limitations must be taken into
account:
NTP service is not available
Messaging service is not allowed on a configured ETY module.
35012068 04/2015 19
Hot Standby Concepts
For more information about the two RUN states in a Premium Hot Standby system, refer to Revised
Operating Modes (see page 33) and to Operating Modes Overview (see page 207).
WARNING
UNINTENDED EQUIPMENT OPERATION
Never assume that a PLC is in a certain operating mode before installing, operating,
modifying, or servicing it.
Before acting on a PLC, always positively confirm the operating mode of both Hot Standby
PLCs by viewing their LEDs and checking their System Status Words.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
20 35012068 04/2015
Hot Standby Concepts
(1) You can find the option to select one pair of ETYs to act as the Monitored ETYs on the Hot Standby tab of
the controller’s configuration. You select the Monitored ETYs using their topological address (their position
on the rack).
35012068 04/2015 21
Hot Standby Concepts
NOTE: For more information concerning the role of the Monitored ETYs in providing a redundant
Ethernet I/O capability, see Minimum Configuration for Redundant Ethernet I/O (see page 66).
NOTE: For more information on configuring your Premium Hot Standby controller in Unity Pro, see
Configuring a System with the Unity Pro Tabs and Dialogs (see page 126). For more information
on configuring your TSX ETY modules in Unity Pro, see Minimum Configuration for Redundant
Ethernet I/O (see page 146).
CPU-sync link
The CPU-sync link is the main communications channel for providing Premium Hot Standby
redundancy. It is established between the Ethernet-based Hot Standby (labeled “HSBY”) ports on
the face of each controller. Each Hot Standby controller’s CPU provides the data passed over the
CPU-sync link, but the management of the actual transmission of this data is the responsibility of
each port’s coprocessor (Copro). It is important that you establish this sync link using an
uninterrupted cable connection, and that you do not use it for any other purpose.
WARNING
UNINTENDED EQUIPMENT OPERATION
Make an uninterrupted point-to-point connection between the Hot Standby CPU-sync link
ports.
Do not connect any other Ethernet devices so that they share the same network cabling as the
CPU-sync link.
Do not exceed maximum Ethernet cable lengths for the type of cable selected.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
ETY-sync link
The ETY-sync link is a channel for the transmission and receipt of additional Hot Standby-related
information, including diagnostic information. In addition, you may use this link to establish
redundant Ethernet I/O (Monitored I/O), and as a provider of other Ethernet services such as
HTTP, FTP, TFTP, and SNMP. You can connect the ETY-sync link directly using a crossover cable
if you do not plan to use Monitored I/O, but this sync link can also be connected using standard
cables through two (2) or more network switches.
22 35012068 04/2015
Hot Standby Concepts
Disconnecting a crossover cable configured with I/O Scanning causes both PLCs to enter the
Offline mode.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not configure the I/O Scanner service when you make a point-to-point ETY-sync link
connection with a crossover cable.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Always confirm that both the CPU-sync link and ETY-sync link are physically connected before
applying power.
If communications equipment such as network switches is part of the ETY-sync link, confirm
that these devices are ON, initialized, and operating properly before applying power.
Route and protect the CPU-sync link and ETY-sync link cables to so that a single accident
cannot disconnect both cables.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
35012068 04/2015 23
Hot Standby Concepts
Overview
Once you understand the requirement for two identical Premium Hot Standby PLCs, two identical
TSX ETY 4103 / 5103 Ethernet modules, and the two sync links between them, you need only add
two identical racks and power supplies to create the core Hot Standby system. This system is
pictured below:
Illustration
24 35012068 04/2015
Hot Standby Concepts
Parts list
The parts list for this core system is as follows:
NOTE: The above hardware is always required in Hot Standby systems, but it does not provide a
useful redundant system, as it includes no redundantly managed I/O. For an introduction to
different types of redundant systems (Ethernet I/O, Analog I/O, etc.), see Hot Standby Systems,
page 55.
35012068 04/2015 25
Hot Standby Concepts
Configuration Requirements
Identical Hardware
Identical Premium Hot Standby controllers, either two TSX H57 24M’s or two TSX H57 44M’s,
with identical CPU and Copro firmware, identical memory cards and accessories, and
occupying the same rack positions. (You can permit differing firmware versions on a temporary
basis so that operational firmware upgrades (see page 235) are possible.
Identical Premium Ethernet communication modules, either two TSX ETY 4103’s or two TSX
ETY 5103’s, with identical firmware of version 4.0 or above, and occupying the same rack
positions.
Identical in-rack I/O, including identical firmware, hardware, revisions (if applicable), and rack
positions. These conditions remain true whether the in-rack I/O is redundant or local.
Identical module cartridges and accessories. For In-rack communication and I/O modules that
accept such accessories, any cartridges used must be identical, and identically positioned and
configured.
Identical Premium TSX RKY ••• racks (backplanes). Each PLC must contain the same number
of racks, using the appropriate line terminations. The rack IDs used must be the same on each
PLC.
Identical Premium TSX PSY ••• power supplies, occupying the same rack positions, and, ideally,
supplied by different feeder circuits.
Identical cabling and cabling systems, fully shielded, and compliant with the length requirements
for the type of fieldbus you employ.
Identical Software
In addition, the following software requirement applies:
Identical application programs must be loaded on both Premium Hot Standby controllers
(see page 34).
26 35012068 04/2015
Hot Standby Concepts
In-Rack Redundancy
In this manual, we refer to two types of in-rack I/O modules: redundant and local. For a pair of In-
rack I/Os modules to function redundantly as part of the Hot Standby system, and therefore be
designated as redundant in-rack I/O, the following must be true:
Each input and output module in one rack must be identical to an input or output module in the
other rack.
You must connect each match I/O pair to a single field device using one of the connection blocks
for discrete I/O (see page 57) or signal duplicator for analog I/O (see page 60). (For example:
an ABE7 connection block is used for discrete I/O.)
You must configure these identical I/O modules for continued parallel operation through
switchover events using the appropriate fallback values for the outputs. The appropriate fallback
values are dependent on your application and the I/O type. In addition, for discrete outputs, the
fallback values depend on whether positive or negative logic is used.
In-rack I/O modules that do not meet the redundancy requirements are referred to as local in-rack
I/O (or just local I/O). Remember that:
While only the Primary controller can affect redundant in-rack I/O modules, the local in-rack I/O
may be operated on by either the Primary or Standby controllers.
Before implementing local in-rack I/O, refer to In-rack I/O Management (see page 180).
Supported Hardware
Multiple racks can be used in Premium HotStandby systems with PLC version 2.83 or higher
(version in synchronization with Unity Pro 6.0). Systems with earlier version do not support
(see page 94) the use of extended racks systems.
Some modules (see page 78) available for other Premium PLCs cannot be used in Hot Standby
systems. In general, the modules that may not be used are the expert function modules such as
counters, etc.
Programming Platform
Only Unity Pro version 3.1 or above can be used to configure Premium Hot Standby systems,
and to manage application programs intended for use on Premium Hot Standby systems.
You must configure at least one pair of ETY modules as the "Monitored ETY" in Unity Pro.
35012068 04/2015 27
Hot Standby Concepts
When your Hot Standby system is operating normally, with the PLCs in either the Run Primary or
Run Standby operating modes (see page 33), the alarm relay is activated and its contact is closed
(state 1). Whenever one of your PLCs enters the Stop or Offline operating modes, or when the
power supply drops out or loses its supply power, the alarm relay falls back and its associated relay
opens (state 0). This figure illustrates these behaviors:
28 35012068 04/2015
Hot Standby Concepts
The state of the alarm relay on each Premium main rack aligns to the Hot Standby controller’s
operating modes (see page 33) as follows:
Hot Standby PLCs Operating Mode State of Alarm Relay on Associated Power Supply
Stop Open
Offline Open
Run Primary Closed
Run Standby Closed
In addition, the redundant power supplies in a Premium Hot Standby system offer three possible
wiring designs for the alarm relays - the relays can be wired in series, in parallel, or independently.
Therefore, in a Premium Hot Standby system, considering operating states and wiring, the number
of possible configurations for the alarm relays is much higher than for a standalone Premium
system. If you plan to use the power supply alarm relays, carefully consider which of these
configurations is appropriate for your system in all operational states.
35012068 04/2015 29
Hot Standby Concepts
Establishing Redundancy
Database Exchange
he Premium Hot Standby provides redundancy by maintaining its Standby PLC and associated
modules in a state where they can assume the Run Primary operating mode quickly. This means
that the Standby PLC has all of the information necessary to mirror the I/O states present on the
Primary PLC, and that this information is regularly updated. For the Premium Hot Standby, the
collected information is called the database and the regular exchange of this database is referred
to as the database transfer.
The database is created by the Primary controller’s CPU just after this CPU has finished evaluating
the input conditions (the %I and %MW values) and the Standby’s Reverse Transfer System Status
Words (%SW62 - %SW65). After the database creation is complete, the Primary PLC transfers the
database to its Copro, which in turn transmits it over the CPU-sync link to the Standby controller’s
Copro. The Standby controller then applies the information in the database as required.
The database that is cyclically transferred from the Primary controller to the Standby controller (via
the Copros and the CPU-sync link) includes both system data and user application data. In both
cases, some of this data is located (addressable) data, and some is unlocated. The data
transferred includes:
System Information:
Located (a subset of the System Bits and Words)
Exchanged during every MAST Task:
30 35012068 04/2015
Hot Standby Concepts
NOTE: In addition to the above, the Primary controller sends the values of all Forced Bits to the
Standby as part of the regular database exchange.
NOTE: The maximum amount of located data that can be transferred in the database is 128 KB
for both the TSX H57 24M and the TSX H57 44M. The maximum unlocated data is 120 KB for the
TSX H57 24M and 300 KB for the TSX H57 44M.
NOTE: The maximum size of the entire database is approximately 165 KB for the TSX H57 24M
and 405 KB for the TSX H57 44M.
NOTE: For specific information regarding the command words and adjustment parameters, and
the maximum memory sizes of these areas, refer to the Unity Pro Operating Modes manual. For a
detailed description of the System Bits and System Words that are exchanged, refer to the Unity
Pro System Bits and Words Reference Manual.
For more information on the database transfer, including information regarding the application of
this information by the Standby, refer to Understanding the Premium Hot Standby Database
Transfer Process, page 105.
Switchover Events
The term Switchover refers to the moment when system control is transferred from the Primary
controller to the Standby controller. The Switchover event has a finite duration, and can be initiated
manually (through Unity Pro or a physical PLC reset) or automatically by system conditions. The
causes of Switchovers, and the behavior of a Premium Hot Standby system when a Switchover
event occurs, is a complex topic covered throughout this manual, and extensively in Detailed
Behavior on Interruption of Power, Communications, or Device Capabilities, page 251.
35012068 04/2015 31
Hot Standby Concepts
While this manual covers Switchover events in some detail, a few general statements will aid in
your understanding of these subsequent topics:
Much of the benefit of the Premium Hot Standby system is its ability to detect various error
conditions and, when warranted, initiate a Switchover. The type of error detected determines
the duration of the Switchover event. For example:
If the Primary PLC remains online, and can communicate with the Standby PLC, but detects
an error that requires a Switchover, it will command the initiation of a Switchover event. See
PLC Communications and Switchover, page 103, for further details.
If the Primary PLC is inoperative, or all communications between the Primary and Standby
controllers are lost, an automatic Switchover occurs.
The behavior of Redundant In-rack I/O during a Switchover event is straightforward. The
requirement for identical hardware and for a recurring, synchronized database transfer
contributes to this simplicity. There are, however, some points that are not immediately obvious:
The fallback settings of Redundant In-rack I/O become very important, and must be
coordinated with the output type, output logic, and the expected application behavior.
There are important differences between the Switchover of Discrete and Analog I/O, See
Minimum Configurations by I/O Type, page 56 for further details.
In the case of network-based I/O (Ethernet and Modbus), an additional layer of complexity is
added during a Switchover event. This is because:
As part of the Switchover, the Hot Standby PLC reassigns the network address associated
with the Primary PLC to the Standby PLC when a Switchover occurs. See Swapping Network
Addresses at Switchover, page 142 for further details.
In addition, other Ethernet services (HTTP, FTP) may be running at the time of a Switchover,
and the PLC will close and reopen these services on the ETYs of the new Primary PLC during
the Switchover event. See Network Effects of Premium Hot Standby, page 155 for further
details.
Local I/O is not part of any automatic Switchover. You should manage your Local I/O in Section
0 of your application program if you would like it to continue to operate after a Switchover.
32 35012068 04/2015
Hot Standby Concepts
In a normally operating Premium Hot Standby system, there are two PLCs running at any given
time, one as the Primary PLC and one as the Standby PLC. Consequently, a Premium Hot Standby
system requires additional, revised operating modes or states to reflect the system status. Further,
the redundant nature of the system means that the relationships between operating modes will
change. The following provides a quick summary of the Premium Hot Standby operating modes:
Stop: The PLC has received a Stop command and has successfully stopped.
Run Primary: The PLC has received a Run command and has assumed the Primary role. It did
not detect another Hot Standby PLC acting as the Primary, or, if both PLCs were started
simultaneously, it had the lower MAC address.
Run Standby: The PLC has received a Run command and has assumed the Standby role.
Either this PLC detected another Hot Standby controller already operating as the Primary, or, if
both PLCs were started simultaneously, it had the higher MAC address.
The PLC in question has received a Stop command or has responded to a detected error and
has left one of the Run (Primary or Standby) operating modes.
WARNING
UNINTENDED EQUIPMENT OPERATION
Never assume that a PLC is in a certain operating mode before installing, operating,
modifying, or servicing it.
Before acting on a PLC, always positively confirm the operating mode of both Hot Standby
PLCs by viewing their LEDs and checking their System Status Words.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: In certain circumstances, such as when no valid application is loaded on a PLC, a Premium
Hot Standby controller will enter and report itself as being in a "Non-Conf" or non-configured state.
This state is not considered an operating mode.
A more in-depth description of the Premium Hot Standby operating modes, including a state / state
transitions diagram, can be found in section Conditions for Switchover, page 207.
35012068 04/2015 33
Hot Standby Concepts
Programming Differences
General
In general, programming a Premium Hot Standby controller with Unity Pro is very similar to
programming any other standalone Premium controller using Unity Pro. Unity Pro provides a user-
friendly, IEC 61131-3 compatible development environment, and most of your programming skills
in other development environments and for other devices will be applicable for the Premium Hot
Standby.
However, there are some important considerations:
Only Unity Pro version 3.1 or above can be used to configure Premium Hot Standby systems,
and to manage application programs intended for use on Premium Hot Standby systems.
The application programs on both PLCs must be identical, or the PLC will report a "logic
mismatch".
If the Hot Standby PLCs are operational at the time a logic mismatch occurs, the Standby
controller will enter the Offline operating state.
If a logic mismatch exists during a simultaneous startup of both the Hot Standby PLCs, one
PLC will start as the Primary, and the other PLC will remain in the Offline operating mode.
If the controllers are started sequentially and a logic mismatch exists, the second PLC that
attempts to start will start in the Offline state.
When the Hot Standby controllers test for a logic mismatch, they normally check three
conditions:
- Whether the application program you have loaded on both PLCs is the same.
- Whether the Unity Pro animation tables for both PLCs are the same.
- Whether the Unity Pro comments for both PLCs are the same.
If the application programs on each PLC are different, this will result in a logic mismatch.
By default, if the animation tables and comments on the PLCs differ, a logic mismatch will
occur. However, you can override this behavior; see Understanding Premium Hot Standby
Logic Mismatch (see page 228) for details.
Some changes to your application programs are possible while online; other changes require
an offline update. See Online/Offline Modifications to an Application Program (see page 229)
for more information.
When connecting Unity Pro to a Hot Standby system, keep in mind that:
Generally, the information you can see in Unity Pro will be the same whether you connect to
the Primary PLC or to the Standby PLC. Most registers on the Standby PLC will reflect the
values provided by the Primary PLC during each MAST task.
However, some differences between the data on the Primary PLC and the Standby PLC do
exist. These exceptions include the located System Words and User Application data
maintained independently on each PLC (%SW61, %MW0 - %MW99).
If you attempt to write values to the Standby PLC’s registers, this will usually be ineffective.
The next database transfer from the Primary PLC will usually overwrite any values you
commanded.
34 35012068 04/2015
Hot Standby Concepts
Users who have programmed PL7 Warm Standby systems or other Hot Standby systems will
notice that many of the events that had to be managed in the application program are now
automatic.
However, your present system requirements may require the programming of redundant
operations. For example, if you want a switchover to be triggered by the detection of an error in
an ETY module that is not configured as the Monitored ETY, you have to manage this in your
application.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use asynchronous, preemptive, or interrupt-driven tasks to program the outputs of your
Premium Hot Standby System.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
35012068 04/2015 35
Hot Standby Concepts
36 35012068 04/2015
Hot Standby Concepts
Typically, the durations of the Input Driver, Application Program, and Output Driver stages are
similar to those found in standalone Premium PLCs.
The time required for the CPU to assemble the database is normally negligible. However, the time
required to transfer the database to the Copro, and for the Copro to communicate this information
to the Standby, scales linearly with the size of the database. For more information on Hot Standby
MAST tasks actions and durations, refer to Database Transfer Between Hot Standby PLCs
(see page 104) and Adjusting MAST Task Properties (see page 190) .
35012068 04/2015 37
Hot Standby Concepts
At a Glance
For Premium Hot Standby applications, some of the programming functionality you may have used
in the past does not apply to redundant operations. This section summarizes these restrictions.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use the PL7 Warm Standby function blocks listed above in a Premium Hot Standby
system.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
38 35012068 04/2015
Hot Standby Concepts
NOTE: For more information on SFC and Grafcet programming, refer to the Startup Guide for Unity
Pro, reference 35008402, and to the Unity Pro PL7 Application Converter User Manual, reference
35006148.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not program your application so that it changes Expert Function parameters unless you
also program your application to transfer these changes to the Standby PLC during each
MAST task.
Do not manually modify Expert Function parameters using the Unity Pro debug screen while
the system is operational.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
35012068 04/2015 39
Hot Standby Concepts
SAVE_PARAM Function
The use of the SAVE_PARAM function is not permitted in a Hot Standby application. This function
overwrites the initial value of a module parameter that is stored in the program code area. This area
is not transferred from the Primary to the Standby in the database.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use the SAVE_PARAM function in a Premium Hot Standby system.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
When using the T_COM_MB IODDT function to determine the Modbus protocol in use, do not
query the high byte of the PROTOCOL variable.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not change the initial values of declared variables using the System Bit %S94.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
40 35012068 04/2015
Hot Standby Concepts
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use the internal control loops.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Section 0 Restrictions
The following restrictions apply only to programming the first section (Section 0) of your application:
Derived Function Blocks (DFB) may not be used in Section 0.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use TON, TOFF, and TP function blocks in Section 0 of your application program.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Follow the suggested procedure below when using asynchronous communication function
blocks.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
35012068 04/2015 41
Hot Standby Concepts
The following procedure should be used to allow asynchronous communication function blocks to
automatically resume operation after a Switchover:
Program your application so that it stores the values of all function block management
parameters in the Non-Transfer Memory Area (%MW0...%MW99).
Initialize the Length parameter each time the function block is called.
Use a separate Timer function block as a replacement for the communication function block’s
Timeout parameter.
NOTE: If for some reason you are unable to follow this procedure, and a Switchover renders your
communication function block inoperative, write your application program so that it sets the
function block’s activity bit to 0 before restarting the function block in the new Primary CPU.
Other Functions
While the use of the functions listed above is restricted, you are advised to use care even when
employing permitted functions that are capable of writing to memory areas that are not part of the
Hot Standby database transfer. For example, the explicit instructions WRITE_CMD and
WRITE_PARAM are both capable of writing non-transferable values and have to be used carefully.
Consider the following example:
If the WRITE_CMD is related to a "Modbus change to character mode" command in a TSX SCP
114 module, this change will only be done in the Primary PLC. If a Switchover occurs, the new
Primary will restart with the Modbus mode rather than the Character mode.
Debugging
Debugging your Hot Standby application program is now a two-stage process:
First, you debug the application on a single Hot Standby PLC as if it were a standalone
application. This allows you to use all of the powerful debugging features available in Unity Pro,
such as watchpoints, etc.
Next, you debug your application when it has been uploaded to two Hot Standby PLCs in a
working redundant system, but in a non-production environment. On this platform, you evaluate
performance specific to Hot Standby redundancy. Only a subset of Unity Pro’s debug features
can be used during this stage.
NOTE: See Debugging Your Hot Standby Application (see page 186) for further details on
debugging your Hot Standby application program.
42 35012068 04/2015
Hot Standby Concepts
This is important because some system behaviors must be commanded in Section 0. Examples
include:
Local I/O, if it is meant to be run from the Standby PLC. This includes switching between
Redundant In-rack Analog I/O signals; see Minimum Configuration for Redundant Analog I/O
(Outputs Only (see page 62) for further details.
Population of the Standby PLC’s Reverse Transfer Registers (%SW62 - %SW65) with custom
diagnostic information for use by the full application program on the Primary PLC.
Other system behaviors must not be commanded in Section 0. For example:
You should not change the values of redundantly controlled discrete outputs in Section 0. The
Standby PLC executes the first section (Section 0) of your application program, and then later
applies the %Q / %QW images received from the Primary PLC. If you alter discrete output bits
in Section 0, the commanded output values for the Standby PLC’s redundant In-rack outputs
might be changed twice in a single MAST task, and the resulting physical state might be
inconsistent with that directed by the Primary PLC.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not change discrete output bit values for redundant outputs in the first section (section 0) of
your application program.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
35012068 04/2015 43
Hot Standby Concepts
44 35012068 04/2015
Premium
Hot Standby Overview
35012068 04/2015
Chapter 2
Hot Standby Overview
35012068 04/2015 45
Hot Standby Overview
Overview
The TSX H57 ••• Hot Standby controllers are very similar to the Premium TSX P57 ••• controllers.
The major changes are firmware-related, primarily affecting the operational behavior of the
controller. However, the changes in the operational behavior also dictate that the physical
indicators, controls, and terminal ports on the front face of the device perform differently.
For example:
The Display Block LEDs behave differently and have different meanings.
The Ethernet port on the front-face of the device is dedicated to the CPU-sync link.
Operating the Cold Start Reset Button has new consequences.
Removing or inserting PCMCIA cards in an operational system will have new consequences.
Illustration
46 35012068 04/2015
Hot Standby Overview
NOTE: Pressing the Cold Start reset button will cause the affected PLC to reboot using default
values instead of cached system and application data. If the affected PLC is the Primary, a
Switchover will occur. If the affected PLC is the Standby, it will return to the Standby role after re-
initializing.
NOTE: Attempting to remove or insert a PCMCIA card while your Hot Standby system is
operational will cause the affected PLC to restart. If the affected PLC is the Primary, a Switchover
will occur. If the affected PLC is the Standby, it will return to the Standby role after re-initializing.
NOTE: Ensure that the PCMCIA card storing your application program is loaded into Slot A on both
PLCs. If the card containing your application program is inserted into Slot B on either or both PLCs,
the system will not start.
Uni-Telway Port
The Uni-Telway port on the face of the Premium Hot Standby PLC can be used for Unity Pro and
HMI / SCADA connections. However, the Uni Telway port is not managed redundantly by the
Premium Hot Standby system. It will remain operable as long as the PLC is operable, but its
address and status do not change during or after a Switchover event.
Therefore, the following points must be understood:
In master mode (default), the Uni-Telway port provides a point-to-point connection with the Unity
Pro workstation or HMI terminal. This physical connection is normally established between the
Unity Pro or HMI station and the designated Primary controller. If a Switchover occurs, the Unity
Pro or HMI station will now be connected to either the new Standby PLC or to an Offline PLC.
In such circumstances, either the connection will be nonfunctional or it may not be immediately
apparent that a Switchover has occurred because the controllers run identical programs and
have similar values in memory. In this second case, attempts to control the Hot Standby system
through the Unity Pro or HMI station will not work as expected.
Even when a Hot Standby controller is connected as a Uni-Telway slave on a larger Uni-Telway
network, no redundant management of the port is possible. The Uni-Telway port’s assigned
slave address will not be automatically swapped during a Switchover. The communications
master, whether a Unity Pro workstation, HMI terminal, or other device, will continue to address
the affected PLC at the old address as if a Switchover had not occurred. Therefore, if you plan
to use the Uni-Telway port for operational purposes, ensure that your system will respond
appropriately if a Switchover occurs.
35012068 04/2015 47
Hot Standby Overview
USB Port
The USB port on the face of the PLC can only be used for a point-to-point slave connection with a
Unity Pro workstation. As with a point-to-point Uni-Telway connection, there is no redundant
management of the USB port. Like the Uni-Telway port, if a Switchover occurs, Unity Pro will now
be connected either to the new Standby PLC or to an Offline PLC. Again, it may not be immediately
apparent that a Switchover has occurred.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use a connection to the Uni-Telway or USB ports as your primary means of controlling a
Premium Hot Standby system.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Verify that a PLC is in the appropriate operating mode before installing, operating, modifying,
or servicing it.
Before acting on a PLC, always positively confirm the operating mode of both Hot Standby
PLCs by viewing their LEDs and checking their System Status Words.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
PCMCIA Differences
Attempting to remove or insert a PCMCIA card while your Hot Standby system is operational will
cause the affected PLC to restart. If the affected PLC is the Primary, a Switchover will occur. If the
affected PLC is the Standby, it will return to the Standby role after re-initializing.
Ensure that the PCMCIA card storing your application program is loaded into Slot A on both PLCs.
If the card containing your application program is inserted into Slot B on either or both PLCs, the
system will not start.
48 35012068 04/2015
Hot Standby Overview
NOTE: For general information regarding the use of PCMCIA cards in Premium PLCs, refer to
Premium and Atrium using Unity Pro Processors, racks, and power supply modules Implemen-
tation manual, reference 35010524, in the chapters Installation and Diagnostics.
35012068 04/2015 49
Hot Standby Overview
NOTE: 1 - When an X-Bus error is detected, it is signaled by simultaneous flashing of the ERR and
I/O LEDs.
NOTE: 2 - The ACT LED indicates the communication activity between the Primary and Standby
PLCs. Because this LED will illuminate during each database exchange (once per MAST task), this
light may appear to be continuously illuminated.
50 35012068 04/2015
Hot Standby Overview
NOTE: For more information regarding the use of LEDs in Hot Standby and non-Hot Standby
Premium controllers, refer to Premium and Atrium using Unity Pro Processors, racks and power
supply modules Implementation manual, reference 35010524, in the chapter TSX P57 / TSX H57
processors diagnostic.
35012068 04/2015 51
Hot Standby Overview
Operating Limits
Environmental
The environmental validation and certification of the Premium Hot Standby controller was identical
to that performed for the TSX P57 ••• PLCs. The environmental qualifications, standards, and limits
for the Premium Hot Standby can be found in the Premium and Atrium using Unity Pro Processors,
racks and power supply modules Implementation manual, reference number 35010524.
Mechanical
The mechanical validation and certification of the Premium Hot Standby controller was identical to
that performed for the TSX P57 ••• PLCs. The mechanical qualifications, standards, and limits for
the Premium Hot Standby can be found in the Premium and Atrium using Unity Pro Processors,
racks and power supply modules Implementation manual, reference number 35010524.
Electrical
The electrical validation and certification of the Premium Hot Standby controller was identical to
that performed for the TSX P57 ••• PLCs. The electrical qualifications, standards, and limits for the
Premium Hot Standby can be found in the Premium and Atrium using Unity Pro Processors, racks
and power supply modules Implementation manual, reference number 35010524.
EMC
The electromagnetic compatibility and emissions validation of the Premium Hot Standby controller
was identical to that performed for the TSX P57 ••• PLCs. The electromagnetic compatibility and
emissions qualifications, standards, and limits for the Premium Hot Standby are in the Premium
and Atrium using Unity Pro Processors, racks and power supply modules Implementation manual,
reference 35010524.
Power Supply
In addition to providing the qualifications, standards, and limits for the Premium Hot Standby
controller, the Premium and Atrium using Unity Pro Processors, racks and power supply modules
Implementation manual, reference 35010524, provides electrical validation and certification
information for the TSX PSY ••• power supplies.
52 35012068 04/2015
Hot Standby Overview
Agency Certifications
Schneider Electric submitted this product for independent testing and qualification by third-party
listing agencies. These agencies have certified this product as meeting the following standards.
North America
UL508, Industrial Control Equipment
CSA Hazardous Locations (Zones CI1 Div2 C22.2, No. 213, Non-Incendive Electrical
Equipment for Use in Class I, Division 2 Hazardous Locations)
Canadian Standards Association, Specification C22.2, No. 142, Process Control Equipment
NOTE: Agency schedules for certifying and listing products are subject to change. For current
information on third-party product certifications, please consult our website
www.telemecanique.com.
Compliance Standards
Schneider Electric tested this product for compliance with the following compulsory standards.
North America
Federal Communications Commission, FCC Part 15
Europe
CE / IEC
Programmable Controllers: IEC 61131-2
EMI: EN55011 (Group 1, Class A)
EMS: EN 61000-6-2
CE / European Directives
Low Voltage: N° 2006/95/EC
Electromagnetic Compatibility: N° 2004/108/EC
Maritime
Bureau Veritas (BV)
Det Norske Veritas (DNV)
Lloyd’s Register of Shipping (LR)
Germanischer Lloyd (GL)
Russian Maritime Register of Shipping (RMRS)
Royal Institution of Naval Architects (RINA)
American Bureau of Shipping (ABS)
Voluntary Standards
Schneider Electric voluntarily tested this product to additional standards. The additional tests
performed, and the standards under which the tests were conducted, are specifically identified in
the Chapter Operating Standards and Conditions in the Premium and Atrium using Unity Pro
Processors, racks and power supply modules Implementation manual, reference 35010524.
35012068 04/2015 53
Hot Standby Overview
CE Compliance Note
The products described in this manual comply with European Directives concerning
Electromagnetic Compatibility and Low Voltage (CE marking) when used as specified in the
relevant documentation, in applications for which they are specifically intended, and in connection
with approved third-party products.
54 35012068 04/2015
Premium
35012068 04/2015
Chapter 3
Hot Standby Systems
35012068 04/2015 55
Section 3.1
Minimum Configurations by I/O Type
56 35012068 04/2015
Minimum Configuration for Redundant Discrete I/O
The minimum configuration necessary to support Redundant Discrete I/O appears below. The
distinguishing features of this configuration are:
The discrete input signals and output values are implemented using ABE7 connection blocks
(using HE10 connectors and cables).
These signals and values are in turn multiplexed / de-multiplexed using a Telefast connection
block.
Errors detected on Discrete I/O cannot cause an automatic Switchover event.
The key design considerations are whether to use positive or negative logic at the outputs, the
configuration of fallback modes based on this decision, and the minimization of output chatter
(see next page).
Illustration
CPU-sync link
Sensor Actuators
Telefast Telefast
connection block connection block
ABE7 ACC11 ABE7 ACC10
ETY-sync link Splitter block, HE10 Splitter block, HE10
35012068 04/2015 57
Parts List
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not change discrete output bit values for redundant outputs in the first section (section 0) of
your application program.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
58 35012068 04/2015
Discrete I/O Fallback Modes
In addition to the guidance in these manuals, please be aware that proper configuration of I/O
fallback modes is essential in providing the redundancy of a Hot Standby system. In general,
outputs should be configured to fallback to their present state to prevent unintended equipment
operation in the short period after the Primary has become inoperative and before the Standby has
assumed the Primary role.
More specifically, in the case of discrete outputs, improper configuration can result in these outputs
becoming locked in the state they last held when one of the PLCs becomes inoperative. To prevent
discrete outputs from freezing when one of the controllers enters an inoperative state, the output
modules using positive logic should use fallback mode 0 while those using negative logic should
use fallback mode 1.
WARNING
UNINTENDED EQUIPMENT OPERATION
Configure your output module fallback modes to prevent changes in output states during
Switchover.
Use fallback mode 0 for all positive logic discrete output modules.
Use fallback mode 0 when output modules are cabled in parallel using ABE7 ACC1•
connection blocks.
Use fallback mode 1 for all negative logic discrete output modules.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: For additional important details on the behavior of Discrete I/O and fallback modes during
Switchover, see Switchover When Primary Becomes Inoperative, page 209.
35012068 04/2015 59
Minimum Configuration for Redundant Analog I/O (Inputs Only)
The minimum configuration necessary to support Redundant Analog Inputs appears below. The
distinguishing features of this configuration are:
The use of a signal duplicator to ensure that the TSX AEY ••• modules on the Primary side and
on the Standby side both receive the correct input signal.
Errors detected on Analog I/O cannot cause an automatic Switchover event.
Illustration
CPU-sync link
ETY-sync link
60 35012068 04/2015
Parts List
35012068 04/2015 61
Minimum Configuration for Redundant Analog I/O (Outputs Only)
Introduction
The minimum configuration necessary to support Redundant Analog Outputs appears below. The
distinguishing features of this configuration are:
The use of a switching interface so that the TSX ASY ••• modules do not simultaneously send
output signals that lead or lag one another.
Errors detected on Analog I/O cannot cause an automatic Switchover event.
The key design consideration is the appropriate use of Section 0 to accomplish output signal
switching.
Illustration
CPU-sync link
Analog output signal B
Actuator
Switching Interface
(example: use two (2) Telemecanique
ABR-2EB312B electromechanical relay
interface modules)
ETY-sync link
Control signal
62 35012068 04/2015
Parts List
WARNING
UNINTENDED EQUIPMENT OPERATION
Design your Hot Standby system so that only one analog output signal at a time is applied to an
actuator.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
35012068 04/2015 63
Analog Output Control Program (Section 0)
In the illustration on the previous page, note that the discrete output module controlling the
switching interface is only connected to the Primary Hot Standby rack (PLC A). This is equivalent
to saying that this discrete output module is locally managed by PLC A - its outputs are Local I/O.
Therefore, as with all Local I/O, the behavior of these discrete outputs should be managed in the
first section (Section 0) of your program. Here is an example in "pseudocode" of this Section 0
programming:
IF (I am the Primary) THEN
Set the Switching Interface to PLC A’s analog signal
ELSE
Set the Switching Interface to PLC B’s analog signal
END IF
In reality, implementing this pseudocode would mean testing the %SW61 status register to
determine the local PLC’s operating mode, and setting the discrete %Q output bits to 1 if in the
Primary mode, or 0 if in any other mode. Therefore, in practice your code would appear more like:
IF (%SW61.0 = 0) AND (%SW61.1 = 1) THEN
%QX.Y = 1
ELSE
%QX.Y = 0
END IF
Now, revisit the illustration and consider the following:
PLC A is the Primary. The code in section 0 of your program executes, and sets the discrete
output bits to 1. The switching interfaces respond to this input by allowing the analog signal from
PLC A to drive the actuator. During this same period, the section 0 code also runs on Standby
PLC B, but to no effect as there is no connection between the discrete outputs on PLC B and
the switching interfaces.
Now, assume that a Switchover has occurred, and PLC A has entered the Standby mode, while
PLC B is the new Primary. PLC A still runs section 0 of the application program, but now will
assert a value of 0 at the discrete output connected to the switching interface. The switching
interfaces will respond to this input by using the analog signal from the new Primary, PLC B, to
drive the actuator.
The last situation to consider is when the PLC controlling the Local I/O can no longer execute
section 0 of the application program. In our example above, such a case would arise if PLC A
detected an error and entered the Offline operating mode. This makes the importance of picking
the proper fallback behavior for locally managed I/O very clear. In the example above, the
proper fallback behavior would be "fallback to zero".
64 35012068 04/2015
Analog I/O Fallback Modes
Proper configuration of I/O fallback modes is essential in providing the redundancy of a Hot
Standby system. Analog module outputs must not be configured to a fallback state to prevent
unintended equipment operation in the short period after the Primary controller has become
inoperative and before the Standby controller has assumed the Primary role.
For the output channels, make sure the Fallback checkboxes are not checked:
WARNING
UNINTENDED EQUIPMENT OPERATION
Uncheck the output module fallback check boxes to prevent changes in output states during
Switchover.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
35012068 04/2015 65
Minimum Configuration for Ethernet I/O
At a Glance
The minimum configuration necessary to support Redundant Ethernet-based I/O appears below.
The distinguishing features of this configuration are:
Because only one pair of ETYs is shown in this configuration, these ETYs are by default the
Monitored ETY modules.
They must serve two roles:
Manage the ETY sync link.
Provide Redundant Ethernet I/O capability.
If an I/O Scanning service is run on these Monitored ETYs, events such as loss of
communication to the attached Ethernet I/O devices can trigger an automatic Switchover event.
Redundant but non-Monitored Ethernet I/O cannot automatically cause a Switchover when it
becomes inoperative. If this behavior is desired, create it in your application program.
The topology of the Ethernet network connected to the Monitored ETYs can take many forms
(tree, ring, etc.) depending on the type of network switches used.
NOTE: For switches in difference network topologies like star, tree or ring, refer to the ConneXium
catalog and Transparent Ready technical publications.
66 35012068 04/2015
Illustration
PLC A ETY A
Network Switch:
499 NSS 251 02
To Ethernet
CPU-sync link ETY-sync link I/O devices
Network Switch:
499 NSS 251 02
PLC B ETY B
Parts List
35012068 04/2015 67
ETY-sync link Diagnostics Example
The ETY-sync link plays an important role in transmitting diagnostic information between the Hot
Standby controllers. The following example demonstrates how the controllers can use this
information to diagnose specific events more accurately.
If the power supply to the Primary PLC is interrupted by some event that does not affect other
modules on the same rack, the Standby PLC initially handles the event as a loss of communication
on the CPU-sync link. This is the same diagnostic that is reported when the CPU-sync link cable
is disconnected. To distinguish between these two cases, the Standby CPU requests from its local
ETY module the status of the remote PLC. Using this secondary communications channel, the
Standby can determine that the Primary controller has experienced a power loss, and assume the
Primary role.
IP Address Considerations
When used in a Premium Hot Standby System, the Ethernet TCP/IP network modules TSX ETY
4103/5103 support address swapping at switchover. If a Premium Hot Standby ETY primary
module initially has the IP address xx.yy.zz.n, then the PLC automatically assigns its counterpart
ETY on the standby rack an IP address of xx.yy.zz.n+1. Therefore, to avoid IP address conflicts,
do not assign consecutive IP addresses to the ETY modules on the primary PLC’s rack.
IP address xx.yy.zz.255 in the primary rack is reserved for TCP/IP broadcast messages, and is not
managed at switchover. You cannot assign IP address xx.yy.zz.254 to an ETY module in the
primary rack because a switchover would cause the corresponding ETY module in the other rack
to take the broadcast IP address xx.yy.zz.255.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not assign consecutive IP addresses to ETY modules in the Primary rack. This will cause
duplicate IP addresses to be assigned to the ETY modules on the Standby rack.
Do not assign the IP addresses xx.yy.zz.254 or xx.yy.zz.255 to any ETY module in a Premium
Hot Standby system.
Do not assign IP address xx.yy.zz.0 to a Monitored ETY, the Monitored ETY will remain in fault
and have its default IP. The CPU thus remains in offline mode.
The Primary and Standby ETYs must reside in the same network and subnetwork.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: If you assign an address of xx.yy.zz.254 or xx.yy.zz.255 to the Monitored ETY modules,
the system will not come online when the Run command is issued, and diagnostic indications will
appear on the PLC and ETY LEDs. However, the controller does not detect IP address conflicts
between non-Monitored ETYs, so there is a potential for network conflicts with these modules.
68 35012068 04/2015
NOTE: For more information on this topic, see Swapping Network Addresses at Switchoverr
(see page 142) and Ethernet Service Switchover Latencies (see page 112).
Number of Switches
If you will use the ETY-sync link to support Monitored Ethernet I/O, connect it through at least two
network switches. If you do not connect it through at least two switches, a loss of communications
on the ETY-sync link causes both PLCs to go Offline.
The sequence of events that would result in both PLCs going into Offline mode is:
1. The single network switch on the ETY-sync link becomes inoperative, and because the I/O
Scanning service is running on the Monitored ETYs, a Switchover will occur.
2. The Primary PLC (PLC A) signals the Standby PLC (PLC B) to assume the Primary role. PLC
A then enters the Offline mode.
3. PLC B assumes the Primary role, and restarts all configured Ethernet services, including the I/O
Scanning service on the ETY-sync link.
4. Because the sole network switch is still inoperative, the new Primary (PLC B) cannot reconnect
to the Monitored Ethernet I/O, and must take itself Offline as well.
WARNING
UNINTENDED EQUIPMENT OPERATION
Connect the ETY-sync link through at least two approved network switches if you plan to use the
ETY-sync link to provide Monitored Ethernet I/O capabilities.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: ETY module connections are described further in: The Sync Links (see page 22).
Configuration of Redundant Ethernet I/O in Unity Pro is described in Configuring TSX ETY
4103/5103 Modules (see page 146) and in the Premium and Atrium Using Unity Pro Ethernet
Network Modules User Manual, reference 35006192.
35012068 04/2015 69
Consider these points before you attempt to hot swap an ETY module in a Premium Hot Standby
system:
Hot swapping a monitored ETY in the primary PLC’s rack triggers a switchover. The primary
PLC goes Offline and the standby PLC takes control of the system. You need to reinitialize the
offline controller in order to restore hot standby capability.
If you hot swap a Monitored ETY in the standby PLC’s rack, a switchover does not occur. The
standby PLC goes offline and the primary PLC remains the primary. The system is not
redundant until you reinitializes the offline controller.
If you hot swap a non-monitored ETY in either PLC’s rack, the system behaves almost
identically to a standalone Premium system. There are no automatic state changes, and your
application program largely determines the resulting behavior.
70 35012068 04/2015
Minimum Configuration for Redundant Modbus I/O
The minimum configuration necessary to support Redundant Modbus-based I/O appears below.
The distinguishing features of this configuration are:
The Modbus addresses of In-rack Modbus modules are automatically reassigned during a
Switchover event.
Errors detected on Modbus I/O cannot cause an automatic Switchover event.
Illustration
35012068 04/2015 71
Parts List
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not change the communications mode (Modbus, Uni-Telway, or Character) of the TSX SCP
114 module while your Hot Standby system is operating.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
72 35012068 04/2015
The following illustration displays the TSX SCY CM 6030 cord connection:
Only the following devices have been tested for use as Modbus slaves on a network including a
Premium Hot Standby system with Modbus capabilities:
Advantys STB
Advantys OTB
Telemecanique ATV31
Telemecanique TeSys U-Line
35012068 04/2015 73
Card Operations
Mounting, dismounting, and connecting / disconnecting cables to the TSX SCP 114 card while
power is applied to the TSX SCY 21601 can damage the card.
CAUTION
EQUIPMENT DAMAGE
Remove all power from your TSX SCY 21601 device before attempting to insert or remove the
TSX SCP 114 communications card.
Remove all power from your TSX SCY 21601 device before attempting to connect or
disconnect cables from the TSX SCP 114 communications card.
Before mounting, dismounting, or connecting cables to the SCP 114, read and understand the
Micro/Premium PLCs TSX SCP 111/112/114 PCMCIA Communication Cards Quick
Reference Guide, reference 1590524.
Failure to follow these instructions can result in injury or equipment damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Create your application program to confirm the receipt and effect of Modbus commands issued
just before and during a Switchover event.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
74 35012068 04/2015
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not assign consecutive slave addresses to Modbus modules in the Primary rack. This will
cause duplicate addresses to be assigned to the corresponding Modbus modules on the
Standby rack, leading to unintended equipment operation.
Do not assign the slave address 98 to any Modbus module in a Premium Hot Standby system.
The automatic assignment of the n+1 address to the Standby Modbus slave will not work in
this event.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: Unlike the Monitored ETY’s IP addresses, there is no error detection preventing the use of
Modbus slave address 98.
35012068 04/2015 75
Adding HMI / SCADA to the ETY-sync link
A switchover from the Primary PLC to the Standby PLC can occur in either of these instances:
The Monitored ETY in the Primary rack becomes inoperative.
The Ethernet link to the Monitored ETY breaks.
You may choose to use an HMI or SCADA device to remotely control your Premium Hot Standby
system. You can maintain remote control through the HMI or SCADA device after a switchover only
when that device is connected to the ETY’s sync link (through a switch). As the figure below shows,
this case requires the connection of the ETY sync link to at least two switches.
NOTE: A failure of the HMI or SCADA device does not cause a switchover.
WARNING
UNINTENDED EQUIPMENT OPERATION
If the Primary PLC will be addressed by HMI or SCADA terminals for the purpose of system
control:
Make the HMI/SCADA connection to the ETY-sync link.
Always run the I/O Scanning service on the Monitored ETY modules.
Use a minimum of two network switches on the ETY-sync link.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: The HMI or SCADA device itself may become inoperable, or the Ethernet link between the
device and the Hot Standby system may be lost, but these conditions do not cause a switchover.
76 35012068 04/2015
The following example shows a Magelis XBT GT HMI panel connected to two 499 NSS 251 02
Ethernet switches that are used for the sync link between the monitored ETY modules in the
Primary and Standby racks. If one of these ETY modules becomes inoperable or if the Ethernet
link is broken, the HMI panel can still monitor and control the system.
CPU-sync link
35012068 04/2015 77
Section 3.2
Compatible Equipment
Compatible Equipment
78 35012068 04/2015
Overview
This section lists all of the modules and equipment that have been tested for use with the Premium
Hot Standby system.
NOTE: In most instances, if you try to put a module that is not on the approved list into a Premium
Hot Standby rack, Unity Pro will recognize that it is a disallowed module and prevent you from
configuring the device in question. The unapproved module will usually appear "grayed out" in both
the pictorial and list representations as illustrated here:
New Device
1
Topological Address: 0.3
The Premium Hot Standby system has other measures to help you avoid the use of unapproved
modules in your Premium racks. For example, if you try to insert a Hot Standby PLC in a rack where
unapproved modules are already present, a dialog alerting you to this fact appears.
If you attempt to compile your application program with an unapproved module still in the rack, your
program compiles as if the device was not there. If the application program is then downloaded to
the PLCs, Unity Pro reports detected errors in the log file, but the program runs as if the slot with
that device was empty. The ERR LED on such unconfigured modules typically illuminate.
35012068 04/2015 79
Despite all of the protections noted above, some modules and configurations may compile without
diagnostic messages but not run as intended. For example, some Modbus communication devices
have a minimum firmware requirement that the Hot Standby controllers do not test. Therefore, you
must only use the compatible equipment listed in this section.
WARNING
UNINTENDED EQUIPMENT OPERATION
Use only the approved In-rack and network-connected modules listed in the following tables. If
unapproved modules are installed, the Premium Hot Standby system may behave in an
unexpected manner during Switchover events.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
80 35012068 04/2015
Premium Racks and Rack Accessories
35012068 04/2015 81
Premium Power Supplies
NOTE: Any Premium TSX PSY ••• power supply may be used with your Hot Standby system,
provided the supplies are identical, identically positioned, and are capable of meeting the power
requirements of your system under maximum load. To determine whether a Premium power supply
will meet the needs of your system, refer to Premium and Atrium using Unity Pro Processors, racks
and power supply modules Implementation manual, reference 35010524, section TSX PSY power
supply modules: breakdown of power consumption and power. This reference provides a means
of calculation Premium system power requirements.
NOTE: Unity Pro also has a feature thay may help you estimate your system’s power consumption.
To access this feature, right-click on the power supply in the X-Bus configuration screen. Select
the "Power Supply and I/O Budget..." menu item. Select the "Power supply" tab when the dialog
box opens.
82 35012068 04/2015
In-rack Communication Modules: Ethernet
Ethernet Modules
The following Ethernet communication modules have been tested for In-rack use in the Premium
Hot Standby system:
NOTE: Please check with Schneider-Electric Technical Support for latest version numbers.
NOTE: Install Modbus communication modules in the main racks. Do not install communication
modules in extended racks.
The communication channel of an Ethernet TSX ETY 4103 or 5103 module connects to a TCP/IP
network that supports Modbus messaging on a TCP/IP profile.
Both devices support:
Modbus messaging
simple network management protocol (SNMP)
electronic mail notification service (SMTP)
input/output management over an Ethernet network (I/O Scanning)
IP address management (BOOTP/DHCP)
dynamic IP addressing (with version 3.2 or higher)
access to the built-in Web server
common data exchange between stations (Global Data)
diagnostics from Web pages
The TSX ETY 5103 module provides two additional capabilities that are not available in the ETY
4103:
FactoryCast, where you have the option to create user Web and TCP Open pages
NTP, which provides time synchronization updates for controller clocks based on a Universal
Time Coordinated (UTC) reference source
35012068 04/2015 83
In-rack Communication Modules: Modbus
Modbus Modules
The following Modbus communication modules have been tested for In-rack use in the Premium
Hot Standby system:
NOTE: Please check with Schneider-Electric Technical Support for latest version numbers.
NOTE: The combination of the TSX SCY 21601 base with the TSX SCP 114 multiprotocol card
allows your Premium Hot Standby controllers to act either as the Modbus master or as a slave or
as character mode. This configuration allows the use of third-party Modbus masters. The
TSX SCY 11601 module can only operate as the Modbus master.
NOTE: Install Modbus communication modules in the main racks. Do not install communication
modules in extended racks.
NOTE: It is recommended to use the TSX SCP 114 (see cabling example (see Premium and
Atrium Using Unity Pro, Asynchronous Serial Link, User Manual)) with version 3.3 or higher when
it is running with a TSX SCY 21601 coupler.
84 35012068 04/2015
In-rack I/O Modules: Discrete
The following Premium Discrete I/O modules have been tested for In-rack use in the Premium Hot
Standby system:
35012068 04/2015 85
In-rack I/O Modules: Analog
The following Premium Analog I/O modules have been tested for In-rack use in the Premium Hot
Standby system:
86 35012068 04/2015
In-rack I/O Modules: Safety
The following Preventa Safety modules have been tested for In-rack use in the Premium Hot
Standby system:
35012068 04/2015 87
Connection Devices: Discrete I/O
The Premium Hot Standby system relies on special I/O connections to enable redundancy. The
following connection devices and cables have been tested for use as redundant Discrete I/O
connections in Premium Hot Standby systems:
88 35012068 04/2015
Connection Devices: Main Rack Analog I/O
35012068 04/2015 89
Allowed Devices: Connected by Ethernet
The following table presents the I/O modules and other devices that can be redundantly controlled
by a Premium Hot Standby system over an Ethernet connection:
90 35012068 04/2015
Allowed Devices: Connected by Modbus
Modbus TCP/IP
The following table presents the I/O modules and other devices that can be redundantly controlled
by a Premium Hot Standby system over an Ethernet (Modbus TCP/IP) connection:
NOTE: These Modbus slaves can only be controlled via Ethernet TCP/IP if an appropriate Ethernet
/ Modbus gateway is used. The following Ethernet / Modbus gateways were tested with the
Premium Hot Standby system:
TSX ETG 100 gateway
TSX ETG 1000 gateway
174 CEV 30020 gateway
Modbus Slaves
These devices have been tested in the role of Modbus slaves in a Premium Hot Standby system:
35012068 04/2015 91
Ethernet Network Devices
All products of the ConneXium family that are compatible with standard TSX ETY 4103 / 5103
Ethernet modules in a non-Hot Standby configuration are expected to be compatible with the TSX
ETY 4103 / 5103 modules in a Hot Standby system. The following Ethernet devices have been
tested for use with the Premium Hot Standby system:
NOTE: when using a STB NIP 2212 in a Premium HotStandby application, the Link Failure Mode
(in the STB Configuration Web pages) should be set to Fallback option, otherwise a bump could
be seen on the outputs.
92 35012068 04/2015
Modbus Network Devices and Cables
35012068 04/2015 93
Maximum Configuration
The following tables provide a summary of the maximum system configurations possible using the
Premium Hot Standby PLCs and their compatible equipment.
For a given type of module, the maximum number of usable modules can be evaluated as: the
maximum number of usable channels divided by the number of channels for this type of module,
provided that a sufficient number of slots is available and other potential limitations (communication
load, etc.) are met.
94 35012068 04/2015
Characteristics TSX H57 24M
Execution time Basic Boolean instruction 0.039/0.057 s
Basic digital instruction 0.053/0.073 s
Floating point instruction 0.55/0.63 s
System overhead MAST task 1 ms
35012068 04/2015 95
Characteristics TSX H57 44M
Execution Basic Boolean instruction 0.039/0.057 s
time Basic digital instruction 0.054/0.073 s
Floating point instruction 0.55/0.63 s
System MAST task 1 ms
overhead
NOTE: For more technical information regarding the capacity and performance of the Premium Hot
Standby PLCs, refer to Additional Information, page 241 and to the Premium and Atrium using
Unity Pro Processors, racks, and power supply modules Implementation manual, reference
35010524.
96 35012068 04/2015
Section 3.3
Example Hot Standby Systems
35012068 04/2015 97
System with Multiple ETYs Running I/O Scanning Services
Illustration
Now that the minimum configurations of each type of I/O and communications module have been
introduced, we will consider a few representative sample systems. The following graphic shows a
Premium Hot Standby System with multiple ETYs, and with three of these paired ETYs running I/O
Scanning services:
HMI Software:
Monitor
Pro
5
1
Shared Monitored Shared I/Os
2 I/Os (*)
OTB ATV61
Primary
Redundant In-
ETY
ETY
ETY
AEY
DSY
1 rack I/Os
4 ABE7 Con-
nection Tele
3 fast
ETG1000 Block
OUT
Standby
ETY
ETY
ETY
AEY
DSY
Momentum
(*) “Monitored” means that an automatic Switchover will occur if the associated ETY become inoperative, or the cable to the first switch becomes discon-
nected.
NOTE: An Ethernet ring configuration will be non-functional unless you use managed switches.
Other network configurations can use both managed and unmanaged switches.
98 35012068 04/2015
Parts List
35012068 04/2015 99
System with Redundant I/O and SCADA Network Services
Illustration
The following graphic shows a Premium Hot Standby System with Redundant I/O and SCADA
network services:
XBT G
2
1 3
HMI Software:
Monitor Pro
Redundant
Extension In-rack I/Os
DEY
ASY
DSY
SCY
ASY
AEY
XBT GT
TEsysU
5 5 5
5
5
4 7
5 5 5
Ethernet
I/O Scanner
Ring
ATV61
10
XBT G
Extension 11 9
Standby
Modules
Actuator
Switching
SCY
AEY
ASY
DEY
ASY
DSY
ETY
ETY
ETY
Interface
(*) “Monitored” means that an automatic Switchover will occur if the associated ETY become inoperative , or the cable to the first switch becomes disconnected.
NOTE: An Ethernet ring configuration will be non-functional unless you used managed switches.
Other network configurations can use both managed and unmanaged switches.
The following graphic shows a Premium Hot Standby System with mixed Ethernet and Modbus I/O.
Illustration
HMI Software:
XBT G
Monitor
Pro
2
1
ATV61
Primary TEsysU
STB Premium CPU
Ethernet 5
ETY
ETY
SCY
DEY
DSY
TCP/IP 6
ETY
1 Ring
6 6
3 6 TEsysU
4
5
Standby
1 Shared Monitored
I/O (*)
ETY
ETY
SCY
DEY
DSY
(*) “Monitored” means that an automatic Switchover will occur if the associated ETY or the first switch become inoperative, or if the cable to the first switch
becomes disconnected.
NOTE: An Ethernet ring configuration will be non-functional unless you use managed switches.
Other network configurations can use both managed and unmanaged switches.
Parts List
Chapter 4
PLC Communications and Switchover
Section 4.1
Database Transfer Between Hot Standby PLCs
Overview
A Premium Hot Standby System requires two backplanes, one for the Primary controller and one
for the Standby. These backplanes and their modules must be configured with identical hardware,
software, and firmware. One of the controllers (PLCs) functions as the Primary controller and the
other as a Standby controller.
The Primary updates the Standby at the beginning of every scan.
The Primary monitors the health of the system according to its programming, and regularly
communicates this status information to the Standby. The Standby provides health information
to the Primary by means of the Reverse Transfer System Words.
If the Primary becomes inoperative, the Standby takes control within one scan.
- A subset of the system data managed by the Primary PLC’s operating system. This subset
includes system counters used by function blocks such as TON, TOFF, and others.
User Application Data
Located
- All %M, %MW, %MD, and %MF data from address 100 up to the maximum number of
global address fields configured in Unity Pro’s Configuration tab, but no more than 128 KB.
The range below 100 (for example, %MW0 - %MW99) is not transferred.
- The output (%Q) objects and any output forcing settings.
- EDT / DDT when they are located by the user.
- Sequential Function Chart (SFC) data types.
Unlocated
- EDT / DDT when they are located by the user.
- Function Block (EFB / DFB) data types.
NOTE: In addition to the above, the Primary controller sends the values of all Forced Bits to the
Standby as part of the regular database exchange.
NOTE: The maximum amount of located date that can be transferred in the database is 128 KB
for both the TSX H57 24M and the TSX H57 44M. The maximum unlocated data is 120 KB for the
TSX H57 24M and 300 KB for the TSX H57 44M.
NOTE: The maximum size of the entire database is approximately 165 KB for the TSX H57 24M
and 405 KB for the TSX H57 44M.
Primary PLC
Scan n Scan n + 1
User Data
Located + Unlocated Data
(max. 128 + max. 300 kilobytes)
Standby PLC
Wait + Hsby First Output Input Wait + Hsby First Input Wait + Hsby First
section section Output section Output
CPU
Scan n
In a Premium Hot standby, the workload is divided between the CPU and the Copro:
CPU performs application program processing
Copro performs communication transfer
The use of the Copro to perform the database transfer mitigates the longer scan times noted
above, and significantly reduces communications latencies in the Hot Standby as compared to
legacy Warm Standby systems.
Performance Considerations
A Premium Hot Standby increases the length of MAST task scan times, creating system overhead.
NOTE: It takes a short but finite amount of time for the system to create the database and copy it
from the PLC’s internal memory into the Copro’s shared memory. We refer to this period as the
System Overhead.
System overhead is the time required to copy the application data to the communication link layer.
The network scan (communication between Primary and Standby Copros)
1. exchanges data between both controllers
2. runs in parallel with the application program
In most circumstances, as pictured on this page, the time required to transmit the database
between the Copros will not affect the MAST task period.
However, when processing large or intensive application programs, the additional system
overhead and transmission times can affect the MAST task duration.
Examples
Example #1
Application program execution time in standalone Premium PLC: 80 ms
Database size: 100 Kilobytes
NOTE: Input and Output driver scan time depends on type of I/O and number of I/O. It’s immaterial
compared to the total scan time.
Example #2
Application program execution time in standalone Premium PLC: 80 ms
Database size: 300 Kilobytes
Chapter 5
Switchover and Swap in Premium Hot Standby
Purpose
This chapter describes the performance, the latencies of a Switchover event and a presentation of
a Swap event in a Premium Hot Standby system.
Description
The following table details the typical and maximum delays likely to be encountered in
reestablishing Ethernet services during a Switchover event:
NOTE: The first scan of the new primary is based on the Inputs and Outputs transferred from the
old Primary, and not on the current values of the IO.
Description
The Switchover time is the time between the last update of an output by the old Primary and the
first update of the same output by the new Primary.
The following table shows the Switchover time for In-rack I/O:
NOTE: The Watchdog value that you configure in your Premium Hot Standby application has a
direct impact on the Switchover time (in case of an interruption of the supply power to the Primary
CPU or disconnection of the CPU-sync link).
NOTE: Depending on the Watchdog time you set, the maximum swap times for Ethernet services
(see previous page) can be exceeded.
Definition
In a redundant configuration:
a Switchover happens in reaction to an internal or external error detected in the PLC. It results
in the loss of the formerly Primary PLC and the change of state of the Standby PLC to the
Primary PLC.
a Swap is a voluntarily action (usually part of the Unity Pro application) that consists in
exchanging roles of the Primary and the Standby PLCs. For example, if PLC A is Primary and
PLC B is Standby at time 0, then, at time 1, after a Swap has been performed, PLC A has
become Standby and PLC B has become Primary.
WARNING
UNEXPECTED EQUIPMENT OPERATION
The HSBY_SWAP (see page 194) DFB must be called for the purpose of testing the application
only.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Overview
The communication Function Block (Com FB) manager is not transferred when a Swap or a
Switchover occurs. A consequence of this functionality (Swap) is that the Com FB which have been
launched in the Primary CPU just before the Swap, can no longer be managed when this CPU
becomes a Standby CPU.
The communication resources are not cancelled automatically. After a time all resources can be
consumed. So after several Switchovers, we have the possibility to get a system without free
resources.
Follow the rules provided here to reduce the possibility of consuming all resources due to Swaps
and Switchovers.
These rules are common to the following Com FB, for all protocols and all networks (serials link,
modbus TCP...)Switchover
DATA_EXCH
INPUT_BYTE
INPUT_CHAR
OUT_IN_CHAR
OUT_IN_MBUS
PRINT_CHAR
RCV_TLG
READ_ASYN
READ_GDATA
READ_VAR
SEND_REQ
SEND_TLG
UNITE_SERVER
WRITE_ASYN
WRITE_GDATA
WRITE_VAR
Activity Bit: This bit indicates the execution status of the communication function. It is set to 1 when
launched, and returns to 0 when the execution is complete. It is the first bit of the first element of
the table.
The following is a description of the mandatory data to take care of in the implementation of the
Com FB:
Location of the 4 managements words:
It is mandatory that all the Com FB located in the first section of the application must have
their 4 management words localized in the %MW between 0 and 99 (Non-Transfer Area
(see page 160)).
For the other sections, it is recommended that the 4 management words of the Com FB are
located in the Non-Transfer Area.
Definition of the Timeout: The timeout value of the Com FB must be reinitialized each time that
a Function Block is used.
Chapter 6
Compatibility with PL7 Systems
Systems created for Premium PLCs using PL7 may be converted to the Unity Pro-Premium Hot
Standby platform and gain the benefits of automatic PLC redundancy and I/O redundancy,
including Ethernet address swapping on Switchover.
In the case of upgrades from a PL7 Warm Standby system to a Premium Hot Standby system,
consider the implementation of existing Fipio devices, and remember that the exchange of data
and state information between the Primary and Standby PLCs is now automatic. This automation
means that in most cases the information transfer necessary to support redundant In-rack I/O does
not require user programming. This is different from and an improvement on the PL7 Warm
Standby system. The following bullets summarize some of these considerations:
You can only connect Fipio devices to a Premium Hot Standby system through an Ethernet-to-
Fipio gateway. You can implement a gateway of this type using a stand-alone Premium PLC
with integrated Fipio and Ethernet ports, or an integrated Fipio port and an Ethernet
communication module.
Because the database transfer necessary to support Hot Standby redundancy is now largely
automatic, many of the function blocks and expert functions used are no longer applicable, and
if used, will prevent your application from compiling and running. The obsolete functions are:
Derived Function Blocks (DFBs) specifically used for data exchange:
- Ha_db_basic
- Ha_db_cycle_opt
- Ha_db_size_opt
Expert Functions (EFs) used to provide data and context exchanges in Sequential Function
Chart (SFC) / Grafcet programming:
- Get_stat_chart
- Set_stat_chart
For more information on Grafcet programming, refer to the Startup Guide for Unity Pro,
reference 35008402.
The following legacy function blocks are specific to Premium PL7 Warm Standby behavior,
and are inconsistent with Hot Standby redundancy and must not be used:
- PL7_COUNTER
- PL7_DRUM
- PL7_MONOSTABLE
- PL7_REGISTER_32
- PL7_REGISTER_255
- PL7_TOF
- PL7_TON
- PL7_TP
- PL7_3_TIMER
In addition to the general considerations noted above, you should be aware of the PL7-Unity Pro
Converter tool. This application will, in some cases, be able to accomplish the conversion of a
Warm Standby PL7 program to one that will function on Unity Pro and a Hot Standby PLC.
NOTE: The PL7-Unity Pro Converter tool will not convert the obsolete functions (DFBs and EFs)
noted above. This can render your application program non-functional. The PL7-Unity Pro
Converter will notify you of any features that are not successfully converted by text displayed in the
Unity Pro watch window. Refer to the Unity Pro Application Converter User Manual, reference
35006148, for further information on this tool.
NOTE: While the PL7-Unity Pro Converter provides a good foundation for beginning your program
conversions, it cannot be comprehensive. In all cases, a thorough code review and rigorous testing
will be required, particularly to integrate with new Premium Hot Standby features, such as the
handling of Ethernet I/O to provide redundancy. Refer to the Unity Pro Program Languages and
Structure Reference Manual, reference 35006144, and the Unity Pro 3.1 Operating Modes
manual, reference 33003101, for further details on programming your system using Unity Pro.
35012068 04/2015
Part II
Configuration and Use
Purpose
This Part describes installation and usage considerations specific to the Premium Hot Standby
system.
This section does not describe the basic physical installation of the Premium Hot Standby CPU,
rack, power supply, or associated hardware. It also does not provide related information such as
operating limits, grounding, electromagnetic compatibility, or other environmental considerations.
For details on these topics, please refer to Premium and Atrium Using Unity Pro Processors, Racks
and Power Supply Modules Implementation Manual, reference 35010524, and Grounding and
Electromagnetic Compatibility of PLC Systems Basic Principles and Measures User Manual,
reference 33002439, located at www.telemecanique.com.
The four chapters included in this Part are:
Configuring in Unity Pro
Programming/Debugging
Operating
Maintaining
NOTE: Read and understand the following documents before attempting the procedures in this
manual:
Premium and Atrium Using Unity Pro Processors, Racks and Power Supply Modules Implemen-
tation Manual, reference 35010524.
Grounding and Electromagnetic Compatibility of PLC Systems Basic Principles and Measures
User Manual, reference 33002439.
Both manuals can be found at www.schneider-electric.com..
Chapter 7
Configuring in Unity Pro
Overview
This chapter describes configuring the Premium Hot Standby PLCs.
Section 7.1
Configuring a System with the Unity Pro Tabs and Dialogs
Purpose
This section describes configuring the specific features of the Premium Hot Standby CPUs
TSX H57 24M or TSX H57 44M.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not attempt to modify your Premium Hot Standby PLC or In-rack module configurations in
Unity Pro while your system is operational.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
For configuring other standard features, refer to the Unity Pro 3.1 Operating Modes manual,
reference 33003101.
Overview
Unity Pro is a Software package for programming Modicon Premium, Modicon Quantum, Modicon
M340, and Modicon Atrium PLCs.
It provides several tools for application development including:
Project browser
Configuration tool
Data editor
Program editor
The configuration tool is used to:
Create, modify, and save the elements used to configure the PLC station
Set up the application-specific modules
Diagnose the modules configured in the station
Control the number of application-specific channels configured in relation to the capacities of
the processor declared in the configuration
Assess processor memory usage
The minimum version of Unity Pro to be used to program a Hot Standby Premium Monorack
application is Unity Pro V3.1 with SP1 (Service Pack 1).
The minimum version of Unity Pro to be used to program a Hot Standby Premium Multirack is Unity
Pro V5.0 with HF1 (Hot Fix 1).
Step Action
1 Open the X-Bus configuration editor either by double-clicking on the X-Bus or by selecting the
X-Bus and executing right-click Open.
A graphical representation of the local bus appears in the configuration editor.
2 Select the Premium Hot Standby CPU module and right-click.
The context menu appears.
Viewing
The read-only Overview tab of the editor displays detailed information about the module’s
specifications.
SPECIFICATIONS
Discrete I/O 1024
Analog I/O 80
Application 0
specific channels
Network connections 2
Bus connections
AS-i 0
-
Third-party 0
Process control 10
VISUAL INDICATORS
Memory cards
A: No memory card selected
Default values
NOTE: The Cold Start Only check box is present only if the current selected PLC can support it.
Step Action
1 Select the Animation tab.
2 The PLC screen tab appears automatically.
NOTE: The dialogs illustrated in this section are depicted as they appear when Unity Pro is not
connected to the PLC. When Unity Pro is connected to a PLC, the information displayed in these
tabs changes.
Network address
PLC / Memory RAM CPU size
Application / Name
Identification
Creation Product (will display "Unity Pro"
followed by version number)
Creation Date
Modification Product (will display "Unity Pro"
followed by version number)
Modification Date
Application Program Version (based on
incrementing system counter)
Signature
System Application / Option Upload Information (the information necessary Only available online
Information to upload a binary PLC application to Unity Pro (when PLC is
and convert it back to source code for connected to PC and
modification) Unity Pro is in
"Connected Mode").
Comments
Animation Table
Section Protection (lock application sections to
prevent modification)
Application Diagnostic
Application / Forced Bits
Miscellaneous
The following table presents the values that may appear in the Information Tab for the
"HOTSTANDBY" category:
9 One or more ETY modules does not have the Value=0: No. All ETY have the minimum
minimum firmware version, v4.0. required version.
Value=1: Yes. Replace old ETY.
WARNING
UNINTENDED EQUIPMENT OPERATION
Configure your output module fallback modes to prevent changes in output states during
Switchover.
Use fallback mode 0 for all positive logic discrete output modules.
Use fallback mode 0 when output modules are cabled in parallel using ABE7 ACC1·
connection blocks.
Use fallback mode 1 for all negative logic discrete output modules.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Step Action
1 If not opened, open the X-Bus configuration editor.
2 Go to the local bus in the Structural View of the Project Browser.
3 Open the local bus either by double-clicking on the X-Bus or by
selecting the X-Bus and executing right-click Open.
A graphical representation of the local bus appears.
4 Point to and select either PC Card A (slot 1) or PC Card B (slot 2).
Step Action
5 Double-click or right-click either PCMCIA card.
The New/Replace Submodule dialog appears.
Overview
The following material describes the handling of network addresses at Switchover.
NOTE: All the ETY modules that are present in a Hot Standby PLC will swap the IP address at
Switchover.
When used in a Premium Hot Standby System, the Ethernet TCP/IP network modules TSX ETY
4103 / 5103 support address swapping at Switchover. If a Premium Hot Standby ETY module
initially has IP address xxx.xxx.xxn, then the PLC automatically assigns its counterpart ETY on the
Standby rack an address of xxx.xxx.xxn+1. Therefore, to avoid IP address conflicts, do not assign
consecutive IP addresses to the ETY modules on the Primary PLC’s rack.
Also, do not assign any ETY module on the Primary rack the addresses xxx.xxx.254 or
xxx.xxx.255. The latter address is reserved for TCP/IP broadcast messages, and is not managed
at Switchover. The reason why xxx.xxx.254 is not assigned is that the counterpart ETY module on
the Standby rack would automatically assume an IP address of xxx.xxx.255, and begin
broadcasting to all other Ethernet devices on the same subnet.
WARNING
RISK OF UNINTENDED EQUIPMENT OPERATION
Do not assign consecutive IP addresses to ETY modules in the Primary rack. This will cause
duplicate IP addresses to be assigned to the ETY modules on the Standby rack, leading to
unintended equipment operation.
Do not assign the IP addresses xxx.xxx.254 or xxx.xxx.255 to any ETY module in a Premium
Hot Standby system.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: If an address of xxx.xxx.254 or xxx.xxx.255 is assigned to the Monitored ETY, The system
will not come online when the Run command is issued, and diagnostic indications will appear on
the PLC and ETY LEDs. However, these addresses are not checked in the case of additional non-
Monitored ETYs on the rack, so there is a potential for network conflicts with these modules.
NOTE: For more information on this topic, see Ethernet Service Switchover Latencies, page 112.
When a Switchover event occurs, there is a possibility that some Modbus messages will not reach
the intended devices. Program your application to confirm that the station addressed on the
Modbus link has received and responded correctly to a message before sending the next
message. For example, this may involve buffering all outgoing Modbus commands, trapping the
occurrence of a Switchover event, and using the buffered commands to check the values of the
commanded registers for compliance. This programming must occur in the first section (Section 0)
of your application program.
WARNING
UNINTENDED EQUIPMENT OPERATION
Create your application program to confirm the receipt and effect of Modbus commands issued
just before and during a Switchover event.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not assign consecutive slave addresses to Modbus modules in the Primary rack. This will
cause duplicate IP addresses to be assigned to the corresponding Modbus modules on the
Standby rack, leading to unintended equipment operation.
Do not assign the slave address 98 to any Modbus module in a Premium Hot Standby system.
The automatic assignment of the n+1 address to the Standby Modbus slave will not work in
this event.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: Unlike the Monitored ETY’s IP addresses, there is no error detection preventing the use of
Modbus slave address 98.
Do not change the communications mode (Modbus, Uni-Telway, Character) of the TSX SCP 114
module while the Hot Standby system is operational. The Primary controller does not update the
Standby controller when this TSX SCP 114 configuration information changes. If this information
is changed when the Hot Standby system is operating, and then a Switchover event occurs, the
communications mode can change unexpectedly.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not change the communications mode (Modbus, Uni-Telway, or Character) of the TSX SCP
114 module while your Hot Standby system is operating.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: The T_COM_MB IODDT (I/O Derived Data Type) may cause unpredictable behavior when
used to query the high byte of the communications PROTOCOL variable. Only the low byte should
be queried using this function.
WARNING
UNINTENDED EQUIPMENT OPERATION
When using the T_COM_MB IODDT function to determine the Modbus protocol in use, do not
query the high byte of the PROTOCOL variable.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Section 7.2
Configuring TSX ETY 4103/5103 Modules
Purpose
This material describes configuring TSX ETY 4103/5103, Premium Ethernet modules, using Unity
Pro. For a more thorough description of the two ETY modules (hardware installation, functions,
configuration, programming, Ethernet language objects), see the Premium and Atrium using Unity
Pro Ethernet Network User Manual 35006192.
NOTE: The Global Data Publish/Subscribe Service is disabled in Unity Pro when configuring
Premium Hot Standby systems.
Please note
Because the user can configure several ETY modules in each PLC, the Monitored ETY modules
that are dedicated to the ETY-sync link (only one ETY module in each PLC) must be designated
using the "Topological address of the Monitored ETY module" option in Unity Pro.
The Monitored ETY is the ETY module that manages the ETY-sync link.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not configure the I/O Scanner service when you make a point-to-point ETY-sync link
connection with a crossover cable.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
If the Primary PLC will be addressed by HMI or SCADA terminals over the ETY-sync link for the
purposes of system control:
Always run the I/O Scanning service on the Monitored ETY modules.
Use a minimum of two network switches on the ETY-sync link.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
If the ETY-sync link will be used to support Monitored Ethernet I/O, then it must be connected
through at least two network switches. If it is not connected through at least two switches, a loss
of communications on the ETY-sync link will result in both PLCs entering the Offline operating
mode.
WARNING
UNINTENDED EQUIPMENT OPERATION
Always connect the ETY-sync link through at least two approved network switches if the ETY-
sync link will be used to provide Monitored (redundant) Ethernet I/O capabilities.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Operating Modes
The ETY modes are:
Primary Mode
The associated PLC (the PLC in the same rack as this ETY) is acting as the Hot Standby
Primary. All client/server services configured to run from this ETY module are active.
Standby Mode
The associated PLC is operating as the Standby. All client/server services configured to run
from this ETY module are active, with the exception of I/O Scanning.
Offline Mode
The associated PLC is in either the Stop or Offline mode. The client/server services operate
identically to the Standby state.
The Premium Hot Standby and the ETY operating modes are reported by Unity Pro according to
the following table.
Any one of four events will affect the ETY operating mode. These four events occur when the ETY
is powered-up, when an ETY executes a Hot Standby Switchover, when an ETY goes to offline
mode, or when a new application is downloaded to the PLC associated with the ETY.
The Primary and Standby states are assigned on system startup. See Start/Stop System,
page 200 for details.
When its associated CPU stops or enters its Offline mode, the HSBY ETY goes to the Offline mode.
The IP address is determined by whether or not the other controller is in transition to the Primary
state.
Step Action
1 A Switchover event occurs.
System A CPU sends Offline command to HSBY ETY, ETY resets all server/client connections.
2 System A CPU informs System B CPU that a Switchover event has occurred and it is to become
the Primary.
3 System B CPU commands HSBY ETY B to begin acting as the ETY associated with the new
Primary PLC.
4 System A HSBY ETY initiates an exchange of UDP messages with System B HSBY ETY to
coordinate the IP address Switchover.
IP Address Assignment
IP Address Restriction
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not assign consecutive IP addresses to ETY modules in the Primary rack. This will cause
duplicate IP addresses to be assigned to the ETY modules on the Standby rack, leading to
unintended equipment operation.
Do not assign the IP addresses xxx.xxx.254 or xxx.xxx.255 to any ETY module in a Premium
Hot Standby system.
The Primary and Standby ETYs must reside in the same network and subnetwork.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
IP Address Transparency
For continued Ethernet communication, the new Primary ETY must have the same IP Address as
the former Primary ETY. The IP Address in the Standby ETY (an ETY in the Standby state) is the
configured IP Address + 1.
The ETYs integrated into the Premium Hot Standby configuration coordinate this IP Address
swapping with the management of any Ethernet services such as FTP or HTTP that are configured
on these ETYs.
Browsers
The Premium Hot Standby’s ability to automatically switch over Ethernet I/O and configured
Ethernet services affects the performance of the Ethernet services. These affects occur
immediately before, during, and after a Switchover. You will need to consider these effects when
you design your Hot Standby system.
If a browser has requested a page served by one of the ETY modules whose IP address is
controlled by the Hot Standby system and a switchover event triggers an IP address swap during
the download, the browser times out. Click the Refresh or Reload button.
During a Switchover, in the period after the Primary has closed the I/O Scanner, and before the
Standby has assumed the Primary role and restored the Scanner, the input and output values of
all scanned Ethernet devices must be controlled to prevent unintended equipment operation.
For Monitored Ethernet inputs, this is normally accomplished using the "Last Value" option
available in the I/O Scanning configuration table of the ETY module in Unity Pro. This value must
be set to "Hold Last" to prevent changes in the input values of scanned Ethernet devices.
For Monitored Ethernet outputs, control of the output states during Switchover is usually asserted
by selecting the "Hold Last Value" option (or equivalent) available in the configuration tool provided
with the Ethernet device. If an Ethernet device does not have a "Hold last value" option, then the
associated outputs may transition states briefly during a Switchover.
WARNING
UNINTENDED EQUIPMENT OPERATION
Use Unity Pro to program all scanned Ethernet I/O inputs to use a "Last Value" option of "Hold
Last".
Use the Ethernet configuration tool that came with your Ethernet output device to select the
"Hold Last Value" option, if available.
If your scanned Ethernet outputs do not support the "Hold Last Value" option, only use these
outputs to control systems and processes that can sustain a momentary value change without
adverse effects.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
It is possible to exchange information over I/O Scanning services using communication Function
Blocks. In the period immediately before, during, and after a Switchover event, it is possible that a
communication Function block will not successfully begin or conclude a transaction with the I/O
Scanner. Program your application to avoid any behaviors that might arise from this.
WARNING
UNINTENDED EQUIPMENT OPERATION
Write your application program to confirm and if necessary resend messages passed to and from
the I/O Scanner using communication Function Blocks.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not configure the I/O Scanning services on multiple ETY modules to scan the same I/O device
or IP address.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
FTP/TFTP Server
The File Transfer Protocol/Trivial File Transfer Protocol (FTP/TFTP) server is available as soon as
the module receives an IP address. Any FTP/TFTP client can log on to the module. Access
requires the correct user name and password. Premium Hot Standby allows only one active
FTP/TFTP client session per ETY module.
When the Hot Standby Switchover occurs, the Primary and Standby ETYs close the FTP/TFTP
connection. If a user sends an FTP/TFTP request during the Switchover, the communication is
closed.
Whenever you re-open communication, you must re-enter a user name and a password.
HTTP Server
NOTE: Take care that HTTP connections are not closed by system on swap. They are closed after
a 2 hours timeout.
Section 7.3
Configuring Registers
Configuring Registers
Purpose
This material describes configuring a Premium Hot Standby system by selecting options that affect
the Hot Standby-specific registers. You may want to use this method if your system has specific
configuration needs.
Overview
In accordance with IEC 61131-3 standards, Unity Pro uses global objects called System Bits and
System Words. These Bits and Words are used to manage the states of the two PLCs.
A Non-Transfer Area
The Non-Transfer Area is the block of %MW that is not transferred from Primary to Standby during
the update of the standby CPU controller.
This block is from %MW0 to %MW99.The size of this block can not be changed.
This is a major difference compared to Modicon Quantum Hot Standby products where the size of
this Non-Transfer area is defined by the user (%MW1 to %MWx).
More information can be found in the "System Technical Guide - High Availability solutions"
available from Schneider.
WARNING
UNINTENDED EQUIPMENT OPERATION
Follow the firmware upgrade procedure (see Executing the Firmware Upgrade Procedure,
page 237).
Always refresh your application program after a firmware download.
When the firmware upgrade has been completed, restore the Primary PLC’s Command
Register Bit 4 (%SW60.4) to a value of 0.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: Only the Standby PLC actually performs checks to determine if there is a CPU, Copro, or
ETY firmware mismatch.
35012068 04/2015
Chapter 8
Programming/Debugging
Programming/Debugging
Overview
This chapter describes the programming and the debugging of an application intended for use on
a Premium Hot Standby system.
However, it only focuses on the aspects of programming and debugging that differ in a Hot Standby
system. For a more comprehensive explanation of Unity Pro programming and debugging see:
Premium and Atrium Using Unity Pro User Manual, reference 35006160
Startup Guide for Unity Pro, reference 35008402
Unity Pro 3.1 Operating Modes, reference 33003101
Unity Pro Program Languages and Structure Reference Manual, reference 35006144
Purpose
This section describes the rules for developing an application in a Premium Hot Standby system.
General points
For programming a Premium Hot Standby PLC, it is important to understand how the Primary
PLC’s processor performs reading of inputs, application program processing, updating of outputs
and Copro access.
ABE7 ACC11
PRIMARY PLC Connection block STANDBY PLC
Modules and
Modules and channels
channels Input Driver health bits
health bits Input Driver
(Discrete) (Discrete)
%I memory
%I image
memory
image Copro access Database exchange including %Q Wait and
objects (the output image) deter- Copro access
mined by the application program
during the preceding MAST task.
MAST/First section MAST/First
MAST
task section MAST
MAST/Other sections cycle task
MAST/Other cycle
sections
The desired state of the
outputs (the output im-
age) is determined by the Not executed
application program and
written to the %Q bits and
%QW words.
%Q Outputs Driver
Outputs Driver %Q (Discrete)
memory (Discrete)
image memory
image
CPU DO
CPU DO
ABE7 ACC10
Connection block
Physical Output
CPU E CPU E
SWITCH
T T
Y Y
%MW Input
%MW Input Input Driver memory
image Input Driver
memory (Ethernet) (Ethernet)
image
MAST/First MAST/First
section MAST
task section MAST
MAST/Other cycle task
MAST/Other cycle
sections sections
CPU E CPU E
T T
Y Y
SWITCH
SWITCH
NOTE: The Standby does not read the %MW Input values directly because no I/O Scanner is
active on the Standby’s Monitored ETY. The Standby PLC receives these %MW Input values from
the Primary as part of the database transfer.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not change discrete output bit values for redundant outputs in the first section (section 0) of
your application program.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNITENDED EQUIPMENT OPERATION
Design your Hot Standby system so that only one analog output signal at a time is applied to an
actuator.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
It is also possible to manage actuators locally in both PLCs. In this case, actuators are not
connected in parallel on two output modules but directly to one output module in each PLC. All
such locally-managed outputs must be managed in Section 0 of your application program, or they
will not be available on the Standby PLC, which only runs Section 0 of your application program.
Also, the memory areas used to control Local I/O must not include or overlap the memory areas
included in the Hot Standby database transfer.
Use the first section (section 0) of your application program to control non-redundantly
managed Local I/O.
Do not use memory areas included in the Premium Hot Standby database transfer to control
these same Local I/O, or the cyclical database transfer will overwrite the intended I/O states.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Starting with Unity Pro V6.0, Primary and Standby PLCs can send character requests via the
PRINT_CHAR function in the first section. An application using this function in the first section must
be able to abort an invalid call to it, otherwise, information may be lost due to collisions.
NOTICE
LOSS OF INFORMATION
Do not use the PRINT_CHAR function in the first section unless the application can abort this
function in case of an invalid call to this function.
Failure to follow these instructions can result in equipment damage.
Processor configuration
There are two types of MAST task execution modes:
Cyclic - the MAST task executes as rapidly as possible.
Periodic - the MAST task delays execution (if necessary) to observe a user-defined minimum
cycle time.
When the Periodic mode is used, the user-defined period should take into account the longer
MAST task periods necessary in a redundant system.
The following table presents the characteristics of MAST tasks that may be adjusted by the user in
Unity Pro:
Characteristics Unity Pro Default Values
Max period (ms) 255
Default period (ms) 20 (Note: Set 80 ms as an initial value for Hot Standby systems)
Min. period (ms) 1 (0 if the Cyclic MAST task execution mode is selected)
Period increment (ms) 1
Max Watchdog (ms) 1500
Default Watchdog (ms) 250
Min. Watchdog (ms) 10
For more details, refer to the section Adjusting MAST Task Properties (see page 190).
Restricted Functions
Refer to the section Restricted Functions (see page 38) for an explanation of all restricted-use
functions in a Premium Hot Standby system.
Detecting Cold Start and Warm Start in a Premium Hot Standby PLC
In a Premium Hot Standby PLC, only the system word %SW10 and the system bit %S1 can be
used to detect respectively a cold start and a warm start.
%SW10
If the value of the bit representing the current task is set to 0, this means that the task is
performing its first cycle after a cold start.
%SW10.0: assigned to the MAST task.
%SW10.1: assigned to the FAST task.
At the end of the first cycle of the MAST task, the system sets each bit of the word %SW10 to 1.
Principle
To take control of the process when the Primary PLC leaves the Primary mode, the Standby PLC
has to know the complete status of the Hot Standby configuration. This status transfer is
accomplished through the assembly and transmission of a database of all relevant information.
The database that is cyclically transferred from the Primary controller to the Standby controller (via
the Copros and the CPU-sync link) includes both system data and user application data. In both
cases, some of this data is located (addressable) data, and some is unlocated. The data
transferred includes:
System Information:
Located (a subset of the System Bits and Words)
Exchanged during every MAST Task:
NOTE: In addition to the above, the Primary controller sends the values of all Forced Bits to the
Standby as part of the regular database exchange.
NOTE: The maximum amount of located data that can be transferred in the database is 128 kB for
both the TSX H57 24M and the TSX H57 44M. The maximum unlocated data is 120 kB for the TSX
H57 24M and 300 Kb for the TSX H57 44M.
NOTE: The maximum size of the entire database is approximately 165 kB for the TSX H57 24M
and 405 Kb for the TSX H57 44M.
For more details on language objects and IODDTs for discrete and analog functions, refer to the
Application language objects chapter of the "Discrete I/O Modules, Unity Pro" user manual,
reference number 35010512, or to the "Analog I/O Modules, Unity Pro" manual, reference number
35010447.
Illustration
The following illustration displays the information calculated, assembled, and transferred by the
Primary PLC:
Exchange
The database is built automatically by the Primary PLC’s Operating System and is sent to the
Standby PLC during each MAST task. This exchange is performed via the embedded Ethernet
coprocessors of the two Hot Standby PLCs.
The approximate maximum size of database is:
TSX H57 24M: 165 kB
TSX H57 44M: 405 kB
The data storage area is a memory zone that can be used to backup and restore data in the
memory card using specific EF in the application program. The maximum size of this area is 8
MByte (with TSX MRP F 008M).
This memory zone is not part of the database exchange between the Primary and the Standby
controllers. It’s only possible to read data using two memory cards (one card in PLC A and one
card in PLC B) with the same contents.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not change discrete output bit values for redundant outputs in the first section (section 0) of
your application program.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: The duration of the pulsed command as seen by the controlled device is slightly longer than
the equivalent command received from a standalone PLC. There will be no discernible difference
in behavior at the device.
NOTE: Because the delay in applying the output images is longer than the commanded change of
state, the actual device will execute the command twice if it is capable of reacting quickly enough.
WARNING
UNINTENDED EQUIPMENT OPERATION
Design your system so that short-duration changes to output states have a duration greater than
the maximum delay between the Primary and Standby PLC’s application of their output images.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: The duration of the pulsed command as seen by the controlled device is slightly shorter
than the equivalent command received from a standalone PLC. There will be no discernible
difference in behavior at the device, unless that device is incapable of responding in a timely
fashion to the foreshortened pulse command.
NOTE: Because the delay in applying the output images is longer than the commanded change of
state, the actual device will never see the pulse command.
WARNING
UNINTENDED EQUIPMENT OPERATION
Design your system so that short-duration changes to output states have a duration greater than
the maximum delay between the Primary and Standby PLC’s application of their output images.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Purpose
This section provides information that will help you debug programs created for use on your
Premium Hot Standby system.
Introduction
You can write an application for your Premium Hot Standby system in almost the same manner as
you would for any a standalone Premium PLC. The Premium Hot Standby system does not require
the use of special function blocks or user actions to support its high availability. There are some
important exceptions (see page 38) to this statement.
When you are conducting the second stage of debugging, confirm that you initially connect to the
PLC currently acting as Primary. The Standby PLC only executes section 0 of your application
program.
System Debug
Debug and verify system performance of Hot Standby-related applications only on a Hot Standby
PLC. Do not use the debug and diagnostic operations for standalone Premium PLCs on a Hot
Standby system.
NOTE: A Switchover is not generated when the Primary application stops on a breakpoint.
The debugging that can be accomplished once your application program is loaded onto a
redundant Hot Standby system is:
Static verification
Check that:
The application restrictions noted in this manual have been observed
The MAST task characteristics have been configured properly
Dynamic verification
After the application has been transferred, make sure that the two PLCs are behaving in
accordance with Premium Hot Standby requirements:
Once the Hot Standby PLCs have entered either the Primary or Standby operating modes, confirm
that:
All application program sections are executed on the Primary PLC
Only the first section is executed in the Standby PLC
Introduction
After a reminder on MAST task execution modes, this part describes the Execution time
measurement method and gives the procedure to adjust the MAST task period.
In the cyclic execution mode, MAST tasks occur in sequence with no reference to the system clock,
and hence without any delay between tasks other than a very brief period of system processing.
Almost immediately after one task completes, another begins. Therefore, the actual duration of a
MAST task in cyclic mode can vary significantly depending on the size and activity of the
application, and the number of inputs and outputs to be controlled.
Periodic mode:
In the periodic execution mode, MAST tasks are sequenced according to a countdown timer which
is referenced to the system clock. This countdown timer may be set for a period between 1 and
255 ms. If the countdown expires before the end of the task, the task will complete normally. If this
occurs regularly, the system will appear as if the cyclic MAST task execution mode had been
selected. However, some applications like process control do require regular cycle times. If this is
the case for your application, confirm that the task period is of sufficient length to avoid cyclic-like
behavior.
In this first case, the execution time of the HSBY part (T2’) is increased with the time required to
copy the data base from the CPU memory to the HSBY Copro shared memory.
→execution time of the last MAST cycle = %SW30 = T1 + T2’ + T3 + T4 with
T2’ = T2 + time to copy the data base from the CPU memory to the Copro shared memory.
In this second case, the execution time of the HSBY part (T2’’) is increased with the time to be
waited until the complete transmission of the data base.
→execution time of the last MAST cycle = %SW30 = T1 + T2’’ + T3 + T4 with
T2’’ = T2 + time to copy the data base from the CPU memory to the Copro + time to transmit all the
data on the network and free the Copro shared memory.
In the periodic mode, it appears that the execution time that is measured is lower than in the cyclic
mode. In certain cases, the difference between the two execution modes can be important.
Function Description
The HSBY_SWAP function block is used to initiate the swapping between primary and standby CPU.
EN and ENO can be configured as additional parameters.
This function block is convenient to be used to activate a swap by program logic. This swap
between primary and standby CPU can be performed in the Hot Standby mode only.
Please refer to:
the Modicon Premium Hot Standby with Unity - User Manual (see page 9) for information
regarding Premium hot standby CPUs.
the Modicon Quantum Hot Standby with Unity - User Manual (see Modicon Quantum, Hot
Standby System, User Manual) for information regarding Quantum hot standby CPUs.
This means that when the HSBY is running, the standby PLC becomes the primary PLC, and the
old primary PLC becomes the standby PLC activated by the program logic.
NOTE: It is not mandatory to use this function for performing a hot standby swap. Indeed, you may
rely on register %SW60, as described in the Conditions for Switchover (see page 207) for Premium
or in the Conditions for Switchover (see Modicon Quantum, Hot Standby System, User Manual) for
Quantum.
NOTE: The DFB should not be used in the first section of the application.
WARNING
UNEXPECTED EQUIPMENT OPERATION
The HSBY_SWAP DFB must be called for the purpose of testing the application only.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Step Action
1 Status: PLC-A is the primary controller, PLC-B is the standby controller.
PLC-A sets itself to offline.
Result:
PLC-B becomes the primary controller.
2 Status: PLC-A is offline, PLC-B is the primary controller.
PLC-B sets PLC-A to run-mode
Result:
PLC-A is the standby controller.
3 Status: PLC-A is the standby controller, PLC-B is the primary controller.
EFB outputs will be set.
Result:
Hot Standby swapping function is completed.
Representation in LD
Representation
NOTE: The system words %SW60 and %SW61 reflect the status of the primary and the secondary
PLC.
Step Action
1 Open file 1.
2 Connect to the primary,
3 Ensure the controller order of the primary is A or B.
4 Access
Command Register system bit %SW60.1
If the connected controller order is A.
Command Register system bit %SW60.2
If the connected controller order is B.
5 Set bit to 0.
NOTE: Ensure that the standby switched to primary.
6 Open file 2.
7 Connect to the new primary controller.
8 Access the Command Register system bit used in step 4.
9 Set bit to 1.
NOTE: Ensure that the standby controller is now online.
10 Ensure both primary and standby controllers are in Run Primary and in Run Standby mode.
35012068 04/2015
Chapter 9
Operating
Operating
Overview
This chapter provides information about Operating the Premium Hot Standby System.
Start/Stop System
Purpose
This section describes how to start or stop a Premium Hot Standby System.
WARNING
UNINTENDED EQUIPMENT OPERATION
Always confirm that both the CPU-sync link and ETY-sync link are physically connected before
applying power.
If communications equipment such as network switches is part of the ETY-sync link, confirm
that these devices are ON, initialized, and operating properly before applying power.
Route and protect the CPU-sync link and ETY-sync link cables so that a single accident cannot
disconnect both cables.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Valid applications
When identical, valid applications have already been loaded on both PLCs, the first Hot Standby
PLC to which power is applied will assume the role of the Primary Controller. Therefore, the
controller roles can be determined by delaying the application of power to one PLC using a time-
lag relay or some related means.
When power is simultaneously applied to two Hot Standby PLCs with valid applications, the role of
the Primary controller is automatically assigned based on the respective MAC addresses of the two
PLCs. By default, the PLC with the lowest MAC address becomes the Primary controller.
NOTE: In the event of a Switchover, or if you replace one of the PLCs, the identification of PLC A
and PLC B in Unity Pro may not align with the Primary and Standby operating modes in the manner
you would expect, where PLC A equates to the Primary controller. The same is true for any
physical labels you might apply to your PLCs to distinguish them in your system.
Never assume that a PLC is in a certain operating mode before installing, operating,
modifying, or servicing it.
Before acting on a PLC, always positively confirm the operating mode of both Hot Standby
PLCs by viewing their LEDs and checking their System Status Words.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
MAC Address
The MAC address, visible on the front panel of the PLC, is a 48-bit number written in hexadecimal
notation (6 pairs of 2 digits). The digits used to represent numbers using hexadecimal notation are
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, and F.
Rules to compare two MAC addresses:
The two MAC addresses must be compared from left to right
As soon as there are different digits in the same position in each MAC address, the higher MAC
address is the one where the digit is higher.
Principle
Stopping a Premium Hot Standby System is identical to stopping a standalone or single PLC, but
only if you stop the PLCs in the following order:
Stop the Standby PLC
Stop the Primary PLC
If the Standby PLC is not stopped first, a Switchover will occur when the Primary PLC is stopped.
Switchover
Purpose
This section describes the Switchover of the Premium Hot Standby.
General points
The following state diagram shows a dynamic view of the main Hot Standby states:
Start is commanded
Undefined State
No Self-Tests passed?
Yes NC
Valid application?
No NON-CONF
Yes Not Defined
Last state?
NC Non-Conf Stop
STOP
Run
Offline
RUN Command
No Error
STOP Command
If... Then...
The other PLC is Primary, the two applications are identical The PLC restarts in Standby mode
and this PLC is operating normally
The other PLC is Primary and the two applications are not The PLC restarts in Offline mode
identical or this PLC is not operating normally
There is no remote Primary and this PLC is operating The PLC restarts in Primary mode
normally
There is no remote Primary but this PLC is not operating The PLC restarts in Offline mode
normally
By writing new values to bits 1 and 2 of the %SW60 command register, you can command a
change in the operating modes of the Hot Standby controllers. There are four possible bit value
combinations that may be written, two of which will command a manual Switchover. The following
table describes the four commands and their results:
1 In this case, we are not directly commanding a Switchover. Instead, we are commanding PLC A to enter an Offline
state and we are relying on the system logic to recognize this and change PLC B from Standby to Primary during
the next scan.
NOTE: All changes to the command register %SW60 must be written to the Primary PLC. This
register is copied from the Primary to the Standby PLC during each MAST task. Therefore, any
changes you make directly to the Standby PLC’s command register will be overwritten by this
transfer without taking effect.
NOTE: Bit values written to the %SW60 command register are not persistent. After the PLCs
assume the new operating modes commanded by the write operation, the system automatically
restores both %SW60.1 and %SW60.2 to the default value of 1.
NOTE: All changes to the command register %SW60 must be written to the Primary PLC. This
register is copied from the Primary to the Standby PLC during each MAST task. Therefore, any
changes you make directly to the Standby PLC’s command register will be overwritten by this
transfer without taking effect.
NOTE: Bit values written to the %SW60 command register are not persistent. After the PLCs
assume the new operating modes commanded by the write operation, the system automatically
restores both %SW60.1 and %SW60.2 to the default value of 1.
Application
Full program Full program
program
Output
drivers
Output Fallback mode to 0
module
Data exchange
on ETY-sync link
PLC B
Standby
Read data Read data
Copro
access
First section First section Full program
Application
program
Output
drivers Cycle n-1 Cycle n
Input
drivers
Wait & Wait Wait Wait and Switchover
Switchover
Output
module
Physical
output
WARNING
UNINTENDED EQUIPMENT OPERATION
Configure your output module fallback modes to prevent changes in output states during
Switchover.
Use fallback mode 0 for all positive logic discrete output modules.
Use fallback mode 0 when output modules are cabled in parallel using ABE7 ACC1·
connection blocks.
Use fallback mode 1 for all negative logic discrete output modules.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: In a properly configured system, during a Switchover event, the physical state of the
outputs is maintained at the last value received from the Primary PLC. Before updating the outputs,
the new Primary controller (PLC B in the figure above) refreshes all %I objects from its local
physical inputs (parallel cabling), and then runs the application program to calculates the new
output values.
NOTE: In the case of positive logic outputs, the recommended fallback value is 0. If your
application program sets an output to 1 in the MAST task immediately preceding an event which
causes an automatic switchover, it is likely that this output will go to a 0 state for a short interval
before the new primary PLC comes online and reasserts the 1 value. Use only your redundant
Discrete in-rack I/O for applications that will not be adversely affected by this type of pulse.
WARNING
UNINTENDED EQUIPMENT OPERATION
Only use your redundant In-rack I/O to control systems and processes that can sustain a
momentary value of 0 at the outputs without adverse effects.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
35012068 04/2015
Chapter 10
Maintaining
Maintaining
Overview
This chapter provides information about Maintaining a Premium Hot Standby System.
NOTE: Read and understand the Premium and Atrium using Unity Pro Processors, racks and
power supply modules Implementation manual, reference 35010524, before attempting the
procedures in this Part.
Important Information
If... Then...
Component of Primary becomes inoperative Control shifts to Standby
Component of Standby becomes inoperative Standby goes offline
CPU-sync link becomes inoperative Standby goes offline
Step Action
1 Select Tools →Diagnostic Viewer from the main menu.
NOTE: The diagnostic messages that are stored in the diagnostic buffer are not transferred from
the Primary to the Standby. These messages are written to persistent memory, and are usually not
subject to loss due to unexpected system events. In the event of a Switchover, you may check
these messages through Unity Pro by connecting to the old Primary PLC.
For more details on diagnostic event detection, please refer to Detailed Behavior on Interruption of
Power, Communications, or Device Capabilities, page 251.
Stages Description
1 The Coprocessor in the Standby PLC detects a loss of communication on the CPU-sync link (in
this example due to an inoperative Primary CPU).
2 After the user-defined Watchdog period has elapsed, the Standby Copro reports this error to the
Standby CPU.
3 The Standby CPU sends a message to its local Monitored ETY to get a status of the Primary
PLC through the ETY-sync link.
4 The Standby Monitored ETY attempts to check the status of the Primary PLC until its defined
timeout period has elapsed. Then the Standby Monitored ETY reports an error state on the
Primary PLC to the Standby CPU.
5 The Standby PLC becomes Primary.
Stages Description
1 Before entering the Offline mode, the Primary CPU sends a message to the Standby CPU
through the CPU-sync link commanding it to assume the Primary role.
2 The Standby goes to Primary mode.
Stages Description
1 The Primary PLC determines the status of the Monitored ETY, and through it any Monitored I/O,
once during every MAST task.
2 After receiving an incorrect status, the Primary CPU initiates a mastered Switchover.
3 The Standby goes to Primary mode.
Stage Description
1 The Primary Copro detects that the Standby Copro is not responding normally (in this example,
due to the Standby PLC’s CPU becoming inoperative).
2 The Primary Copro reports this error to the Primary CPU.
3 The Primary CPU stays Primary and updates the remote station status to Offline in its status
register.
Stage Description
1 The Standby Monitored ETY notes a loss of communications on the ETY-sync link.
2 The Standby ETY reports the detection of this error to the Standby CPU.
3 The Standby CPU sends a message to the Primary CPU through the CPU-sync link.
4 If the Status is OK, the Primary continues to act as Primary and the Standby will go to Offline
because of the disconnection on Standby side. If the status is not OK and the Primary is capable
of responding, it will send a "take control" message to the Standby before entering Offline mode.
NOTE: Both the Primary and Standby PLC’s are capable of detecting a loss of communications on
the CPU-sync link. Which PLC actually detects the loss of communications depends on the timing
of the event with respect to the MAST task cycle.
Important Information
Fact Result
A Hot Standby system requires that both stations This requirement prevents the Standby from executing a
must have the same application program. different application program if transfer of control occurs.
Other than the TSX H57 ••• modules themselves, most In-rack modules compatible with the
Premium Hot Standby system can be replaced while the system is running. This is beneficial when
one of your installed modules becomes inoperative, because an inoperative module will usually
cause a Switchover event, with the result that the inoperative module is now on a rack that is in
either the Standby or Offline operating mode. However, do not assume that an inoperative module
you are preparing to replace is on the Standby rack. Always check the operating mode of both
Premium racks before attempting to replace a module.
WARNING
UNINTENDED EQUIPMENT OPERATION
Never assume that a PLC is in a certain operating mode before installing, operating,
modifying, or servicing it.
Before acting on a PLC, always positively confirm the operating mode of both Hot Standby
PLCs by viewing their LEDs and checking their System Status Words.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
In the unlikely event that the inoperative module did not cause a Switchover, do not attempt to
change the module while it still resides on the Primary rack.
WARNING
UNINTENDED EQUIPMENT OPERATION
Never attempt to replace a module residing on one of the Primary PLC backplanes. Only
modules on the Standby PLC backplanes may be replaced while the system is operational.
If the module requiring replacement is on the Primary PLC’s backplane, perform a manual
Switchover and confirm that the Switchover has occurred before proceeding.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
DANGER
HAZARD OF ELECTRIC SHOCK, EXPLOSION OR ARC FLASH
Read and understand the Premium and Atrium Using Unity Pro Processors, Racks and Power
Supply Modules Implementation Manual, reference 35010524, and the documentation for any
module or accessory you are installing, removing, or maintaining to understand whether power
must be removed for these operations.
Always use a properly rated voltage sensing device to confirm that power is off.
Replace and secure all covers and elements of the system before reapplying power.
Confirm that all affected PLCs are loaded with the correct application program before
reapplying power.
Use only the specified voltage for your TSX PSY ••• power supply when placing the system in
operation.
Failure to follow these instructions will result in death or serious injury.
Finally, observe all of the configuration requirements for identical hardware, firmware, and rack
address when replacing a module, or the Standby rack will not be able to exit the Offline mode
when the system is restarted.
LED Description
Permanently ON
OFF
Part III
Modifying and Upgrading
Purpose
This part describes Modifying and Upgrading in a Premium Hot Standby System.
Handling Application Modification
Handling PLC Firmware Upgrades
Chapter 11
Handling Application Modification
Overview
This chapter provides information about application modification in a Premium Hot Standby
system.
When a mismatch exists, the Standby Controller goes to Offline, and a Switchover cannot occur.
Causing a Mismatch
In a Premium Hot Standby System, if the user does any of the following, the Standby will go into
Offline mode:
Conduct an online modification of the application program in the Standby PLC while the Primary
is controlling the process in the Run / Primary mode.
NOTE: Unity Pro does not allow the online modification of the Standby controller until the online
modification of the Primary controller has been completed. This is different than offline
modifications, which are applied to the Standby PLC first.
Conduct an online modification of the application program in the Primary while the Primary is
controlling the process in the Run / Primary mode.
Download an application program modified offline to the Standby.
NOTE: This is a normal occurrence during offline modifications, which require a full application
download.
NOTE: The online modification of an application program occurs when your Hot Standby system
is connected to Unity Pro and you:
Modify the executable code by adding, suppressing or changing an instruction in the code,
Modify a configuration parameter by changing a device or system value in the Unity Pro
configuration screen.
Overview
When the Primary and Standby PLCs have different application programs or system
configurations, the Hot Standby configuration loses its high availability. In these cases, the
Standby PLC enters Offline mode and a Switchover cannot occur. Unlike Quantum Hot Standby
systems, Premium Hot Standby systems do not continue to operate when a logic mismatch exists.
The following procedures describe how the user can modify the application in the two PLCs of a
Premium Hot Standby system with a minimum impact on the process. The two types of
modifications possible are:
Online Modifications
Offline Modifications
Modifications Description
General Name of station, program, section
Comment applied to a station, configuration, program, section
Documentation summary
Animation tables
Integrated operator screen
Functional view
Security information: passwords, protection attributes
Program Sections of program: add, delete, change execution order
Modify the code of the section (program section, SR, Action, DFB sections
Modify the code of SFC chart
Modifications Description
Global variables (used in Symbol on a used variable
animation table or operator Topological address on a used variable
screen) Initial value on a used variable
Comment on a used variable
Create, remove or modify unused variables (EDT, DDT)
Create, remove or modify unused variables (FB)
Used DFB All comments
Add a private or public variable
Delete or change unused private variable
Initial value of parameters and variables
Section of DFB: add, delete, change execution order
Modify the code of a section
Create a new DFB type
Delete an unused DFB type
Used DDT Create a new DDT type
Delete an unused DDT type
Step Action
1 Thouroughly test any modifications you plan to make on a non-operational platform before attempting
an online modification of the operational system.
2 Confirm the operating modes of both PLCs:
Verify that PLC A is in the Run / Primary operating mode.
Verify that PLC B is in the Run / Standby operating mode.
3 Connect Unity Pro to the Primary PLC (PLC A) and enter the "online" connection state. Make any of
the allowed online modifications presented on the preceding page. If you have appropriately planned
for and tested these modifications, you will observe:
The Primary PLC will continue to run as Primary
The Standby PLC will detect a logic mismatch and enter the Offline mode. The system is no longer
operating redundantly at this point.
If the Primary PLC did not continue to run as the Primary, then system operations can be restored by
accomplishing these steps:
Connect Unity Pro to PLC B
Perform a Stop / Run command
This will cause PLC B to reinitialize as the Primary PLC. At this point, you should restore the application
program on PLC A to its previous working state, and conduct more testing on a non-operational test
platform before proceeding. Start again at Step 1 of this procedure when you are ready.
4 After the online modifications have been made to the Primary PLC, evaluate these modifications for
proper operation. If the modified program is operating as expected, save (upload) the application from
the PLC to your Unity Pro PC.
Step Action
5 Connect Unity Pro to PLC B and download the application file from the PC to PLC B.
During the download, PLC B will enter a "Non Configured" or "Non Conf" state.
PLC B will revert to a Stop / Offline state when the transfer is complete.
6 Send a Run command to PLC B. This PLC will now start in the Run / Standby mode. This system is
once again operating redundantly.
WARNING
UNINTENDED EQUIPMENT OPERATION
Never assume that a PLC is in a certain operating mode before installing, operating,
modifying, or servicing it.
Before acting on a PLC, always positively confirm the operating mode of both Hot Standby
PLCs by viewing their LEDs and checking their System Status Words.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: Unity Pro does not allow the online modification of the Standby controller until the online
modification of the Primary controller has been completed. This is different than offline
modifications, which are applied to the Standby PLC first.
NOTE: An online modification in an animation table or in a comment will not generate a logic
mismatch if the Animation tables and Comments option is not checked in the Build Tab of Tools |
Project Settings.
Offline Modification
Make offline modifications on the Standby PLC if the modifications will require a complete
download of the application.
The following table describes modifications that require a complete application download:
Modifications Description
Program Modify the code of EVT sections
Configuration / communication: Add, move, remove an I/O module
Change memory sizes using the configuration screen
Step Action
1 Thoroughly test any modifications you plan to make on a non-operational platform before
attempting an offline modification of the operational system.
2 Confirm the operating modes of both PLCs:
Verify that PLC A is in the Run / Primary operating mode.
Verify that PLC B is in the Run / Standby operating mode.
3 Connect Unity Pro to the Standby PLC (PLC B) and download the modified application program.
During the download, PLC B will enter a "Non Configured" or "Non Conf" state.
PLC B will revert to a Stop / Offline state when the transfer is complete.
PLC A will remain in Run / Primary mode during the download, so the system will be active
but not redundant at the conclusion of this step.
4 Issue a Stop Command to the Primary PLC (PLC A).
PLC A will enter the Stop / Offline mode.
The system is no longer active, nor is it redundant.
5 Issue a Run Command to the old Standby PLC (PLC B). If you have appropriately planned for
and tested your modified application, you will observe:
PLC B will enter the Run / Primary mode
Because PLC A is still in the Stop / Offline mode, the system is now active, but it is not yet
redundant.
If PLC B does not start into the Run / Primary mode, then issue a Stop command and upload a
working (unmodified) version of the application program to both PLCs. Restore the system to an
operational, redundant status. Conduct further testing of the modified application program on a
non-operational test platform before proceeding.
6 Evaluate the performance of the modified application on PLC B (the new Primary) for proper
operation.
7 Connect Unity Pro to PLC A and download the modified application file from the PC.
During the download, PLC A will enter a "Non Configured" or "Non Conf" state.
PLC A will revert to a Stop / Offline state when the transfer is complete.
8 Send a Run command to PLC A. This PLC will now start in the Run / Standby mode. This system
is once again operating redundantly.
WARNING
UNINTENDED EQUIPMENT OPERATION
Never assume that a PLC is in a certain operating mode before installing, operating,
modifying, or servicing it.
Before acting on a PLC, always positively confirm the operating mode of both Hot Standby
PLCs by viewing their LEDs and checking their System Status Words.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: Offline modifications have a greater impact on your system than online modifications
because the offline method always requires system downtime. Further, offline modifications result
in a Cold Start of PLC B (the PLC acting as the Standby before the procedure was started). In other
words, offline modifications will result in PLC B restarting with a reinitialized data context. Plan your
offline modifications of the application program and Hot Standby configuration to account for the
Cold Start of PLC B.
WARNING
UNINTENDED EQUIPMENT DAMAGE
Plan your offline modifications to account for the Cold Start of PLC B.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: Schneider Electric does not recommend the use of the Ethernet connection method to
perform an offline application modification. During the modification process, the PLC operating
modes change frequently, resulting in multiple changes to device IP addresses. Each such change
in IP address will cause a loss of communication with Unity Pro. This will increase your system
downtime and required you to manually reconfigure the new IP addresses in Unity Pro before the
connection can be reestablished. If you do decide to pursue an offline modification over the ETY-
sync link:
When you receive each notice that communication with the PLC has been lost, manually set the
IP address in Unity Pro to the PLC’s new address.
After reconnecting, confirm that you have defined the correct IP address by observing the:
Unity Pro Status bar.
Link status (Offline, Different, Equal).
Hot Standby PLC Status (PLC name A/B, PLC state (Primary, Standby, Offline).
Address of the connected PLC.
Chapter 12
Handling PLC Firmware Upgrades
Overview
In this chapter you will find information regarding the OS upgrade method for a Premium Hot
Standby System. Upgrading allows you to update the OS for the Standby controller while the
process is still being controlled by the Primary controller.
Unity OSLoader
The Unity OSLoader tool includes an "Executive Upgrade" feature that allows the Standby
controller’s firmware (both CPU and Copro) to be upgraded while the Primary controller continues
to control the process. However, during the upgrade, the system can no longer be considered
redundant. That is, there is no Standby available to assume control if the Primary should become
inoperative before the Standby upgrade is complete.
WARNING
UNINTENDED EQUIPMENT OPERATION
Follow the firmware upgrade procedure (see Executing the Firmware Upgrade Procedure,
page 237).
Always refresh your application program after a firmware download.
When the firmware upgrade has been completed, restore the Primary PLC’s Command
Register Bit 4 (%SW60.4) to a value of 0.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: Even when conducting an Executive Upgrade, this upgrade will only be possible if a Hot
Standby-compatible firmware version is used. When the Unity OSLoader first attempts to connect
to a CPU, it will check the CPU’s Hardware ID against the allowed Hardware IDs defined in the
firmware binary file. If there isn’t a match, the Unity OSLoader will not establish the connection.OS
upgrade is possible only with compatible firmware.
General
Perform an a PLC Firmware upgrade using the installed Unity OSLoader tool.
Step Action
1 Connect Unity Pro to the Primary PLC (PLC A) through the Uni-Telway terminal port
2 Access Command Register %SW60; set bit 4 to 1 (OS version mismatch allowed)
3 Stop the Primary (PLC A). Ensure the Standby (PLC B) becomes Primary
4 Disconnect Unity Pro from PLC A
5 Open the OSLoader tool
6 Download the new firmware to PLC A
7 After completing the OS download, perform application program transfer
8 Put PLC A in RUN mode. Ensure PLC A becomes Standby
9 Connect Unity Pro to the other PLC (PLC B, currently acting as the Primary) through the Uni-
Telway terminal port
10 Stop the Primary (PLC B). Ensure the Standby (PLC A) becomes Primary
11 Disconnect Unity Pro from PLC B
12 Open the OSLoader tool
13 Download the new firmware to PLC B
14 After completing the OS download, perform application program transfer
15 Put PLC B in RUN mode. Ensure PLC B becomes Standby
16 Perform a Switchover. Confirm Standby becomes Primary
17 Connect to the Primary and access Command Register %SW60; set bit 4 to 0 (OS version
mismatch not allowed)
WARNING
UNINTENDED EQUIPMENT OPERATION
Never assume that a PLC is in a certain operating mode before installing, operating,
modifying, or servicing it.
Before acting on a PLC, always positively confirm the operating mode of both Hot Standby
PLCs by viewing their LEDs and checking their System Status Words.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
35012068 04/2015
Appendices
At a Glance
The appendices for the Premium Hot Standby are included here.
For additional information on diagnostics, refer to TSX P57/TSX H57 processors: diagnostics.
The Unity Pro online help also provides useful information on error codes and internal bits and
words.
Appendix A
Additional Information
Additional Information
Overview
This chapter describes the design specifications and error codes.
(3): The memory available for unlocated data (EDT, DDT, and Function Blocks) is the size of the physical
memory installed less the memory allocated to the located data.
NOTE: EDT and DDT are in the same memory segment. There is one memory segment per
instance of EFB/DFB.
Application Structure
The following table presents the Application Structure of the CPUs:
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use asynchronous, preemptive, or interrupt-driven tasks to program the outputs of your
Premium Hot Standby System. Only MAST tasks support data synchronization between the
Primary and Standby Controllers.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use asynchronous, preemptive, or interrupt-driven tasks to program the outputs of your
Premium Hot Standby System. Only MAST tasks support data synchronization between the
Primary and Standby Controllers.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use Derived Function Blocks (DFBs) or the TON, TOFF, and TP function blocks in Section
0 of your application program.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not program your application so that it changes Expert Function parameters unless you
also program your application to transfer these changes to the Standby PLC during each
MAST task.
Do not manually modify Expert Function parameters using the Unity Pro debug screen while
the system is operational.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use the PL7 Warm Standby function blocks (see page 38) in a Premium Hot Standby
system.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Supported FLASH PCMCIA (Max application size according TSX MFP P 128K
to PLC characteristics) TSX MFP P 224K
TSX MCP C 224K
TSX MFP P 384K
TSX MFP P 512K
TSX MCP C 512K
TSX MFP P 001M
TSX MFP P 002M
TSX MCP C 002M
TSX MFP P 004M
Supported Data storage TSX MRP F 004M
TSX MRP F 008M
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not use the SAVE_PARAM function in a Premium Hot Standby system.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
When using the T_COM_MB IODDT function to determine the Modbus protocol in use, do not
query the high byte of the PROTOCOL variable.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not change the initial values of declared variables using the System Bit %S94.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
WARNING
UNINTENDED EQUIPMENT OPERATION
Follow the suggested procedure below when using asynchronous communication function
blocks.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
The following procedure should be used to allow asynchronous communication function blocks to
automatically resume operation after a Switchover:
Program your application so that it stores the values of all function block management
parameters in the Non-Transfer Memory Area (%MW0...%MW99).
Initialize the Length parameter each time the function block is called.
Use a separate Timer function block as a replacement for the communication function block’s
Timeout parameter.
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not change discrete output bit values for redundant outputs in the first section (section 0) of
your application program.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Miscellaneous Characteristics
The following table presents the Miscellaneous Characteristics of the CPUs:
TextIDs
TextIDs
TextIds define the diagnostic messages written in the diagnostic buffer.
TextIDs switching from Primary to Offline
Appendix B
Detailed Behavior on Interruption of Power, Communications, or Device Capabilities
Overview
In this chapter you will find the descriptions of Premium Hot Standby behavior when power and
communication interruptions occur, or in the event a device becomes inoperative.
Overview
Introduction
A first level of Hot Standby diagnosis can be done through the %SW61 status register that is
managed locally by each Hot Standby PLC.
You can obtain significantly more diagnostic information by programming your application to test
the status of each In-rack module and its associated channels.
NOTE: If you desire that such custom diagnostic information be maintained for both the Primary
and Standby racks, be sure to observe the following:
Accomplish the collection, processing, and storage of additional diagnostic information in the
section 0 of your application program. Otherwise, the standby PLC does not report current
information.
Program your application so that the additional diagnostic information is stored in nontransfer
area (%MW0 - %MW99). When you do this, the primary PLC cannot overwrite the standby PLC
information during the MAST task database transfer
If any of the PLC’s additional diagnostic information is reported to the primary PLC, use the
reverse transfer system words (%SW62 … %SW65). Remember that the nontransfer area (%MW0
- %MW99) also provides ample space to preprocess diagnostic information that will be sent to
the primary PLC. For example, the Standby PLC might use this area to assemble %S status bits
into a %SW word for insertion into the %SW62 reverse transfer word.
The following pages present an example Hot Standby system, and then describe the responses of
this system to various service or hardware events.
Example of Configuration
The referenced configuration is:
PLC A and PLC B with the following modules:
Power supply (PS)
Hot standby processor (in slot 0)
Monitored ETY module (in slot 2)
Ethernet communication (in slot 3)
Modbus communication (SCY with SCP 114) in slot 4
In-rack Discrete modules (DIS IN and DIS OUT) in slots 5 and 6
Two network switches providing a connection between the Ethernet I/O scanner and a SCADA
or HMI device.
CPU-sync link between the two CPU
Event
HALT instruction Ethernet I/O scanner + SCADA
Watchdog overflow @ @ +1
PLC A PLC B
Program execution error (division by 0, overflow, Primary
Switch Switch
Standby
etc.) with %S78 = 1 PS CPU ETY SCY DIS DIS PS CPU ETY SCY DIS DIS
STOP command IN OUT IN OUT
Event
HALT instruction
Ethernet I/O scanner + SCADA
Watch dog overflow @ @ +1
Program execution error (division by 0, overflow, PLC A Switch Switch PLC B
etc.) with %S78 = 1 Primary Standby
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
STOP command IN OUT IN OUT
Event causes an automatic Switchover: NO
ETH SCP ETH SCP
Note: Program blocking errors may or may not result in Port 114 Port 114
a Halt instruction, depending on user configuration.
@ @+1
Event
Processor hardware or firmware becomes inoperative. Ethernet I/O scanner + SCADA
@ @ +1
Event causes an automatic Switchover: YES PLC A Switch Switch
PLC B
Primary Standby
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
Event
Processor hardware or firmware becomes inoperative.
Ethernet I/O scanner + SCADA
Event causes an automatic Switchover: NO @ @ +1
PLC A Switch Switch PLC B
Primary Standby
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
Event
Loss of supply power to the Primary standard rack. Ethernet I/O scanner + SCADA
@ @ +1
Event causes an automatic Switchover: YES PLC A
Switch Switch
PLC B
Primary Standby
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
Event
Loss of supply power to the Standby standard rack. Ethernet I/O scanner + SCADA
@ @ +1
Event causes an automatic Switchover: NO PLC A PLC B
Switch Switch
Primary Standby
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
Primary Monitored ETY Hardware or Firmware Becomes Inoperative (I/O Scanning Service Active)
The following table presents the effects when the ETY on the Primary PLC’s rack becomes
inoperative while running an I/O Scanning service:
Event
The hardware or firmware of the Primary Monitored ETY Ethernet I/O scanner + SCADA
module that manages Ethernet I/O (or Ethernet I/O + @ @+1
SCADA / HMI) becomes inoperative. PLC A Switch Switch PLC B
Primary Standby
Event causes an automatic Switchover: YES PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
Standby Monitored ETY Hardware or Firmware Becomes Inoperative (I/O Scanning Service Not
Active, But Ready)
The following table presents the effects when the ETY on the Standby PLC’s rack becomes
inoperative while remaining ready to activate an I/O Scanning service (service currently inactive):
Event
The hardware or firmware of the Standby Monitored ETY Ethernet I/O scanner + SCADA
module that can manage the Ethernet I/O and SCADA / HMI @ @+1
becomes inoperative. PLC A Switch Switch PLC B
Primary Standby
Event causes an automatic Switchover: NO PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
Event
Hardware or firmware on the Primary ETY module that Ethernet I/O scanner+ SCADA
manages a dedicated SCADA / HMI connection becomes @ @ +1
PLC A Switch Switch PLC B
inoperative. Primary Standby
PS CPU ETY ETY SCY DIG DIG PS CPU ETY ETY SCY DIG DIG
Event causes an automatic Switchover: NO HMI IN OUT HMI IN OUT
@ @+1
If you will use HMI or SCADA devices to remotely control your Premium Hot Standby system, and
you wish this control to persist through Switchover events, then you should connect the
HMI / SCADA via the ETY-sync link and run the I/O Scanning service on the Monitored ETYs.
However, if you do so, you must use a minimum of two network switches on the ETY-sync link to
reduce the likelihood that a cable disconnection will interrupt HMI / SCADA access.
WARNING
UNINTENDED EQUIPMENT OPERATION
If the Primary PLC will be addressed by HMI or SCADA terminals for the purpose of system
control:
Make the HMI/SCADA connection to the ETY-sync link.
Run the I/O Scanning service on the Monitored ETY modules.
Use a minimum of two network switches on the ETY-sync link.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
Event
Hardware or firmware on the Standby ETY module that Ethernet I/O scanner + SCADA
@+1
can manage the dedicated SCADA / HMI connection PLC A
@
PLC B
Switch Switch
becomes inoperative. Primary Standby
PS CPU ETY ETY SCY DIG DIG PS CPU ETY ETY SCY DIG DIG
Event causes an automatic Switchover: NO HMI IN OUT HMI IN OUT
@ @+1
Event
The Primary PLC’s Copro that manages the Hot Standby
Ethernet I/O scanner + SCADA
CPU-sync link becomes inoperative. The database @ @ +1
exchange between the Primary and Standby controllers PLC A Switch Switch PLC B
Primary Standby
ceases. PS CPU ETY ETY SCY DIG DIG PS CPU ETY ETY SCY DIG DIG
HMI IN OUT HMI IN OUT
Event causes an automatic Switchover: NO
ETH SCP ETH SCP
Port 114 Port 114
@ @+1
Event
The Standby PLC’s Copro that manages the Hot Ethernet I/O scanner + SCADA
Standby CPU-sync link becomes inoperative. The @ @ +1
database exchange between the Primary and Standby PLC A Switch Switch PLC B
Primary Standby
controllers ceases. PS CPU ETY ETY SCY DIG DIG PS CPU ETY ETY SCY DIG DIG
HMI IN OUT HMI IN OUT
Event causes an automatic Switchover: NO
ETH SCP ETH SCP
Port 114 Port 114
@ @+1
Event
CPU-sync link disconnection. The database exchange
Ethernet I/O scanner + SCADA
between the Primary and Standby controllers ceases. @ @ +1
PLC A Switch Switch PLC B
Event causes an automatic Switchover: NO Primary Standby
PS CPU ETY ETY SCY DIG DIG PS CPU ETY ETY SCY DIG DIG
HMI IN OUT HMI IN OUT
@ @+1
X
Event
Ethernet I/O link disconnection on the Primary side. Ethernet I/O scanner + SCADA
There is no more diagnostic dialog between the 2 ETY @ @+1
modules. PLC A
Switch Switch PLC B
Primary X Standby
Event causes an automatic Switchover: YES
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
Event
Ethernet I/O link disconnection on the Standby side.
Ethernet I/O scanner + SCADA
There is no more diagnostic dialog between the two @
@+1
@ @+1
Event
I/O scanner disconnection on the I/O link. The Ethernet I/O scanner+ SCADA
remote I/O are no longer visible from both PLCs but
the diagnostic dialog between the 2 PLCs is still @ X @+1
PLC A PLC B
active. Primary Switch Switch
Standby
Event causes an automatic Switchover: NO PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
NOTE: When redundant Ethernet I/O is disconnected in this manner, upstream of the actual ETY-
sync link switches, no automatic Switchover occurs. If you would like to cause a Switchover or
some other behavior in this situation, you must program it in your application program.
Full ETY I/O Link Disconnection (Both Switches for Monitored I/O Inoperative)
Event
Full Ethernet I/O link disconnection. The remote I/O are no
Ethernet I/O scanner + SCADA
longer visible from both PLCs and the dialog between the @ @ +1
two PLCs is no longer active. PLC A Switch Switch PLC B
Primary Standby
This event is important because both PLCs will be unable to PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
communicate with the Monitored I/O and both will go to the IN OUT IN OUT
@ @+1
WARNING
UNINTENDED EQUIPMENT OPERATION
Always connect the ETY-sync link through at least two approved network switches if you plan to
use the ETY-sync link to provide Monitored (redundant) Ethernet I/O capabilities.
Failure to follow these instructions can result in death, serious injury, or equipment
damage.
NOTE: If both network switches have become inoperative, follow this procedure to restart your Hot
Standby system:
Replace the network switches with functional equipment.
Perform a Stop command followed by a Run command on the PLC you wish to use as the
Primary.
Event
The Discrete I/O module becomes inoperative or is
Ethernet I/O scanner + SCADA
removed from the Primary’s X-Bus rack. @ @ +1
PLC A Switch Switch PLC B
Event causes an automatic Switchover: NO Primary Standby
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
Event
The Discrete I/O module becomes inoperative or is
removed from the Standby’s X-Bus rack. Ethernet I/O scanner + SCADA
@ @ +1
Event causes an automatic Switchover: NO PLC A Switch Switch PLC B
Primary Standby
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
The Modbus SCP Card in the Primary SCY Module Becomes Inoperative
The following table presents the effects when the SCP card in the Primary SCY becomes
inoperative or is removed:
Event
The Primary Modbus SCP card becomes inoperative or is
Ethernet I/O scanner + SCADA
removed. @ @ +1
PLC A PLC B
Switch Switch
Event causes an automatic Switchover: NO Primary Standby
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
The Modbus SCP Card in the Standby SCY Module Becomes Inoperative
The following table presents the effects when the SCP card in the Standby SCY becomes
inoperative or is removed:
Event
The Standby Modbus SCP card becomes inoperative or is
Ethernet I/O scanner + SCADA
removed. @ @ +1
PLC A Switch Switch PLC B
Event causes an automatic Switchover: NO Primary Standby
PS CPU ETY SCY DIG DIG PS CPU ETY SCY DIG DIG
IN OUT IN OUT
@ @+1
Glossary
B
BOOL
BOOL is the abbreviation of Boolean type. This is the elementary data item in computing. A BOOL
type variable has a value of either: 0 (FALSE) or 1 (TRUE).
A BOOL type word extract bit, for example: %MW10.4.
E
EN
EN means ENable, this is an optional block input. When EN is activated, an ENO output is
automatically drafted.
If EN = 0, the block is not activated, its internal program is not executed and ENO its set to 0.
If EN = 1, the internal program of the block is executed, and ENO is set to 1 by the system. If an
error occurs, ENO is set to 0.
ENO
ENO means Error NOtification, this is the output associated to the optional input EN.
If ENO is set to 0 (caused by EN=0 or in case of an execution error),
the outputs of function blocks remain in the status they were in for the last correct executed
scanning cycle and
the output(s) of functions and procedures are set to "0".
I
INT
INT is the abbreviation of single integer format (coded on 16 bits).
The lower and upper limits are as follows: -(2 to the power of 15)+1 to (2 to the power of 15) - 1.
Example:
-32768, 32767, 2#1111110001001001, 16#9FA4.
Index
A H
Allowed Devices, 90, 91 hot standby network effects, 155
Analog I/O (Inputs Only), 60 Hot Standby systems, 97
Analog I/O (Outputs Only), 62 Hot Standby Systems, 55
C I
Certifications and Standards, 53 I/O scanning, 155
checksums, 220 I/O Type, 56
confidence tests, 214 identical applications, 228
configuring, 125 In-rack Communication Modules, 83, 84
Ethernet modules, 146 In-rack I/O Modules, 85, 86, 87
registers, 158 IP addresses
configuring processors, 126 restriction, 153
Connection Devices, 88, 89
controller failures, 223
controller troubleshooting, 223 L
local clients, 155
logic mismatches, 227
D
Database Transfer, 104
diagnosing processors, 223 M
diagnostics maintenance, 213
buffers, 215, 249 Minimum configurations, 56
Discrete I/O, 57 Mixed Ethernet and Modbus, 102
distribution groups, 155 Modbus Network Devices, 93
modes, 150
Multiple ETYs Running I/O Scanning Servic-
E es, 98
error detection, 217
Ethernet I/O, 66
Ethernet Network Devices, 92 O
ETY-sync link, 76 offsets, 142
overhead, 107
F
FTP servers, 155 P
programming, 169
R
Redundant, 57, 60, 62, 66
Redundant I/O and SCADA Network Servic-
es, 100
registers
command, 161
status, 163
remote clients, 155
S
scan times, 107
swapping addresses, 142
Switchover, 30
switchovers
cold start, 166
logic mismatches, 227
swapping addresses, 142
System, 98, 100, 102
system errors, 251
T
TFTP servers, 155
transfer time, 112
TSX H57 24M, 19
TSX H57 44M, 19
U
upgrading, 235