This document discusses high availability SIMATIC automation systems from Siemens. It describes the redundancy features of SIMATIC S7-400H systems including switchover capability, synchronization, self-testing, programming, change-in-run capability, and online repair. Examples are given of industries that benefit from high availability systems such as power generation, chemicals, and transportation. The system architecture, integration, and configuration are outlined.

1. Automation and Drives
High-available
SIMATIC
SIMATIC S7-400H
The high-available Automation System

2. Automation and Drives
Benefits
High-available
SIMATIC
Overview Avoidance of control system failures due to individual faults
 This is attained primarily through a redundant configuration
Redundancy features
 Switchover High-availability is required in the following cases:
 Synchronization  When processing valuable materials
 Self-test  When downtimes or production failures would be expensive
 Programming  When a control system failure would result in high restart costs
 CIR
 In order to enable operation without supervisory or maintenance personnel
 Online repair
Configuration
Communication
Redundant I/O
A&D AS, 07/2004, Chart 2
© Siemens AG 2004 - Subject to change without prior notice

3. Automation and Drives
Industries (1)
High-available
SIMATIC
Overview Power generation and distribution
(oil, gas, electricity)
Redundancy features  Power plants
 Pipelines
 Switchover
 Offshore
 Synchronization
 District heating systems
 Self-test
 Programming Chemical, electrochemical, petrochemical and pharmaceutical
 CIR industries
 Online repair
Mining
Configuration
Environmental engineering
Communication  Water treatment
 Refuse incineration
Redundant I/O
Pulp and paper
Steel and metal
A&D AS, 07/2004, Chart 3
© Siemens AG 2004 - Subject to change without prior notice

4. Automation and Drives
Industries (2)
High-available
SIMATIC
Overview Food and beverages
Redundancy features
Glass industry
 Switchover Semiconductor industry (utilities)
 Synchronization
Transport
 Self-test  Tunnel automation
 Programming  Marine automation
 CIR
 Online repair
Airports
 Runway lighting
Configuration  Baggage transport
Communication
Redundant I/O
A&D AS, 07/2004, Chart 4
© Siemens AG 2004 - Subject to change without prior notice

5. Automation and Drives
System architecture
High-available
SIMATIC
Overview
Clients
Redundancy features Management level Parallel redundancy
 Switchover
Server
 Synchronization PC network/terminal bus Parallel redundancy
With archive-matching
 Self-test
High-available
 Programming communication
Ethernet
 CIR Media
Process level redundancy
 Online repair
H CPUs SW redundancy
Configuration Hot stand-by Warm stand-by
Redundant
Communication power supply
ET 200M
Redundant I/O
Field level
Redundant
PROFIBUS
Redundant
IM 153
A&D AS, 07/2004, Chart 5
© Siemens AG 2004 - Subject to change without prior notice

6. Automation and Drives
System integration
High-available
SIMATIC
Overview Hidden redundancy
 Transparent programming
Redundancy features (programming same as for non-
redundant systems)
 Switchover
 Standard system parameterization
 Synchronization
 Self-test
 Standard handling
 Programming
 CIR All SIMATIC programming
 Online repair languages can be used without restriction
Configuration
Platform for F and
Communication FH systems
Redundant I/O
A&D AS, 07/2004, Chart 6
© Siemens AG 2004 - Subject to change without prior notice

7. Automation and Drives
Bumpless master-stand-by switchover
High-available
SIMATIC
Overview Switchover time
 Switchover time < 100ms
Redundancy features
Redundancy features
 Outputs are retained during switchover
 Switchover
Switchover  No information or alarm/interrupt is lost
 Synchronization
 Self-test
Switchover criteria
Programming
Master failure

 CIR
 Power supply
 Online repair
 Rack
Configuration  Sync module
Communication
 Sync cable
 CPU
Redundant I/O
Failure of a DP string or DP slave interface module does not
force a switchover
A&D AS, 07/2004, Chart 7
© Siemens AG 2004 - Subject to change without prior notice

8. Automation and Drives
Automatic event synchronization
High-available
SIMATIC
Overview Customer benefits
Redundancy features
Redundancy features
Transparent programming
 Allstandard SIMATIC-S7 programming languages
 Switchover
 No command restrictions
 Synchronization
Synchronization
 Self-test
 Easy porting of the user program
 Programming
from standard CPU to high-available CPU
 CIR
 Online repair Bumpless switchover
 No loss of information
Configuration
 No loss of alarms/interrupts
Communication
 Because all redundancy-specific functions are handled by the
Redundant I/O operating system, the user can feel assured that he/she has done
everything right as far as redundancy is concerned
A&D AS, 07/2004, Chart 8
© Siemens AG 2004 - Subject to change without prior notice

9. Automation and Drives
Comprehensive self-test functions
High-available
SIMATIC
Overview Self-test
Redundancy features
Redundancy features Scope:
 Switchover  CPU
 Synchronization  Memory
 Self-test
Self-test
 Synchronization link
 Programming
 CIR
 Online repair
Organization:
 Startup self-test
Configuration
 Complete test
Communication  Self-test in cyclic mode
Redundant I/O
 Executes permanently as
background task
 Executes in its entirety within a specifiable amount of time (default: 90
minutes)
A&D AS, 07/2004, Chart 9
© Siemens AG 2004 - Subject to change without prior notice

10. Automation and Drives
Online programming
High-available
SIMATIC
Overview Online modifications same as for standard system
 All modifications are automatically copied to both CPUs
Redundancy features
Redundancy features
 Switchover Connecting a PG
 Synchronization  At MPI interface
 Self-test
 Via bus
 Programming
Programming
 CIR
 Online repair
Configuration
PROFIBUS/Ethernet
Communication
Redundant I/O
MPI/DP
A&D AS, 07/2004, Chart 10
© Siemens AG 2004 - Subject to change without prior notice

11. Automation and Drives
Configuration in RUN (CIR)
High-available
SIMATIC
Overview CPU memory configuration
Redundancy features
Redundancy features Adding or removing:
 Switchover  Central I/O or CP
 Synchronization  DP slaves
 Self-test
 PA interface and PA slaves
 Programming
 Y-link and slaves
 CIR
 Modules in modular DP slaves
 Online repair
Configuration
CPU parameter
Communication
Redundant I/O
A&D AS, 07/2004, Chart 11
© Siemens AG 2004 - Subject to change without prior notice

12. Automation and Drives
Replacing modules in RUN mode
High-available
SIMATIC
Overview Modules which can be removed and inserted in Run mode
 I/Oand CP
Redundancy features
Redundancy features
 Sync module
 Switchover
 Redundant IM 153-2
 Synchronization
 Redundant power supplies
 Self-test
 Programming
Redundant components which can be replaced with the power
 CIR
off:
 Online repair
 Standard power supplies
Configuration
 Central IM
Communication  CPU
Redundant I/O
 CPU is automatically updated following replacement
(program and data)
A&D AS, 07/2004, Chart 12
© Siemens AG 2004 - Subject to change without prior notice

13. Automation and Drives
Configuration
Highlights new CPUs
High-available
SIMATIC
Overview Performance Increase
 Average Increase
Redundancy features
417-4H appr. x 2,5-3
Switchover

414-4H appr. x 1,2-2,2
 Synchronization  More Memeory
 Self-test
417-4H from 4 MB to 20MB
 Programming
414-4H from 768KB to 1,4MB
 CIR
 Online repair Higher Reliability
Konfiguration
Configuration  Memory with automatic Ewrror Detection and Correction (EDC)
Communication
New Feature
Redundant I/O  Distance between the Controller up to 10km (before 500m)
A&D AS, 07/2004, Chart 13
© Siemens AG 2004 - Subject to change without prior notice

14. Automation and Drives
Configuration
Technical specifications for the CPUs
High-available
SIMATIC
Overview Two CPU types available
 CPU 417-4H with
Redundancy features
20MB onboard
 Switchover  CPU 414-4H with
 Synchronization 1,4MB onboard
 Self-test
 Programming General
 CIR technical specifications,
 Online repair e.g. CPU 417-4 or CPU 414-3
Configuration
Configuration
4 integrated interfaces
Communication  Two for the Sync modules
 One DP interface
Redundant I/O
 One MPI/DP interface
A&D AS, 07/2004, Chart 14
© Siemens AG 2004 - Subject to change without prior notice

15. Automation and Drives
Configuration
Redundant link
High-available
SIMATIC
Overview
Redundancy features
 Switchover
 Synchronization
 Self-test
Replaceable Sync modules
 Programming
 CIR
 Online repair Fiber-optics (FO)
Configuration
Configuration
Communication
Fiber-optics (FO)
Redundant I/O
A&D AS, 07/2004, Chart 15
© Siemens AG 2004 - Subject to change without prior notice

16. Automation and Drives
I/O configuration
Switched I/O: mode of operation
High-available
SIMATIC
Overview Both DP masters are active
and functioning properly
Redundancy features
 Reading inputs:
 Switchover
The inputs are read only
 Synchronization from the preferred channel
 Self-test side (active IM)
 Programming
 Writingoutputs:
 CIR
The data are accepted by
 Online repair both channels.
Configuration
Configuration Only the data in the preferred
channel are forwarded to the
Communication outputs.
Redundant I/O
A&D AS, 07/2004, Chart 16
© Siemens AG 2004 - Subject to change without prior notice

17. Automation and Drives
Redundant I/O
High-available
SIMATIC
Overview
Redundancy features New:
 Switchover Redundant IO
Redundant Communication
 Synchronization
 Self-test
 Programming
Redundant Controller
 CIR
 Online repair
Redundant Profibus
PROFIBUS DP
Configuration
Communication
Sensor/control
Redundant I/O element
Redundant IM
A&D AS, 07/2004, Chart 17
© Siemens AG 2004 - Subject to change without prior notice

18. Automation and Drives
Redundant I/O
Possible redundancy structures (2)
High-available
SIMATIC
Overview Distributed switched
H-CPU in single mode
I/O modules
Redundancy features
 Switchover
 Synchronization
 Self-test
 Programming
 CIR
 Online repair
Configuration
Communication
Redundant I/O
A&D AS, 07/2004, Chart 18
© Siemens AG 2004 - Subject to change without prior notice

19. Automation and Drives
Redundant I/O
Wiring digital inputs
High-available
SIMATIC
With one sensor With two sensors
Overview
DI DI DI DI
Redundancy features
 Switchover
 Synchronization
 Self-test
 Programming DI
 CIR
Master I/O
Redundant Profibus
 Online repair
Both Inputs are read in parallel.
Configuration The correct value is selected and processed automatically
Communication
Redundant I/O
Redundant I/O
DI
Since the function is not suitable for all module types, the manual or Internet should be
consulted to find out which modules can currently be used.
A&D AS, 07/2004, Chart 19
© Siemens AG 2004 - Subject to change without prior notice

20. Automation and Drives
Redundant I/O
Wiring analog inputs
High-available
SIMATIC
With voltage sensor With current sensor With current sensor With 2 sensors
Overview AE-U AE-U AI-I AI-I AE-U AE-U
AE AE
Redundancy features
R
 Switchover
U I I
 Synchronization 4-wire transducers only
 Self-test
 Programming AI
 CIR
Master I/O
Redundant Profibus
 Online repair
The CPU reads both inputs. The correct value is selected
Configuration and processed automatically R I
Communication
Redundant I/O
Redundant I/O
AI
Since the function is not suitable for every module type, the manual or Internet should be
consulted to find out which modules can currently be used.
A&D AS, 07/2004, Chart 20
© Siemens AG 2004 - Subject to change without prior notice

21. Automation and Drives
Redundant I/O
Wiring digital outputs
High-available
SIMATIC
With diodes * Without diodes* * Dependant on the
Overview
DQ DQ DQ DQ module type
Redundancy features
 Switchover
 Synchronization
 Self-test
 Programming DO
 CIR
Master I/O
Redundant Profibus
 Online repair Actuator
Both Outputs are set
Configuration
Communication
Redundant I/O
Redundant I/O
DO
Since the function is not suitable for every module type, the manual or Internet should be
consulted to find out which modules can currently be used.
A&D AS, 07/2004, Chart 21
© Siemens AG 2004 - Subject to change without prior notice

22. Automation and Drives
Redundant I/O
Wiring analog outputs
High-available
SIMATIC
Overview Each Output outputs half the value.
Redundancy features
When one of the modules fails, the output that is still intact
provides the full value
 Switchover
 Synchronization
 Self-test
 Programming AO
 CIR
Master I/O
Redundant Profibus
 Online repair Actuator
Both Outputs are set
Configuration
I
Communication
Redundant I/O
Redundant I/O
AO
Since the function is not suitable for all module types, the manual or Internet should be
consulted to find out which modules can currently be used
A&D AS, 07/2004, Chart 22
© Siemens AG 2004 - Subject to change without prior notice

23. Automation and Drives
High-available
SIMATIC
Overview
Redundancy features
 Switchover
 Synchronization
 Self-test
 Programming
 CIR
 Online repair
Configuration
Communication
Redundant I/O
A&D AS, 07/2004, Chart 23
© Siemens AG 2004 - Subject to change without prior notice