Consistent Data Access without the Use of SFC 14 or SFC

Consistent data access > 4 bytes is also possible without using SFC14 or SFC15. The data area of a DP slave which is to be transferred consistently will be written to a process image partition. The data in this area are thus always consistent. You can then access the process image partition using the load / transfer commands (L EW 1, for example). This represents a particularly comfortable and efficient (low runtime load) method to access consistent data and to implement and configure such devices as drives or other DP slaves.

Any direct access to a data area which is configured consistent, such as L PEW or T PAW, does not result in an I/O access error.

Important aspects in the conversion from the SFC14/15 solution to the process image solution are:

• When converting from the SFC14/15 method to the process image method, it is not recommended to use the system functions and the process image at the same time. Although the process image is updated when writing with the system function SFC15, this is not the case when reading. In other words, consistency between the values of the process image and of the system function SFC14 is not ensured.

• SFC 50 ”RD_LGADR” outputs another address area with the SFC 14/15 method as with the process image method.

• When using a CP 443-5 ext, the parallel use of system functions and of the process image leads to the following errors:read/write access to the process image is blocked, and/or SFC 14/15 is no longer able to perform any read/write access operations.

Example:

The example of the process image partition 3 ”TPA 3”below shows a possible configuration in HW Config:

• TPA 3 at output: those 50 bytes are stored consistently in process image partition 3 (pull--down list ”Consistent over --> entire length”), and can thus be read by means of standard ”load input xy” commands.

• Selecting ”Process Image Partition --> ---” under input in the pull--down menu means: do not write data to the process image. You must work with the system functions SFC14/15. .

S7-400H

This chapter features an introduction to the subject of S7-400H redundant systems.

You will learn the basic concepts that are used in describing how redundant systems operate.

Following that, you will receive information on redundant system modes. These modes depend on the operating modes of the different redundant CPUs, which will be described in the section that follows after that one.

In describing these operating modes, this section concentrates on the behavior that differs from a standard CPU. You will find a description of the normal behavior of a CPU in the corresponding operating mode in the Programming with STEP 7 manual.

The final section provides details on the modified time response of redundant CPUs.

In Section Description On Page

6.1 Introduction 6-2

6.2 System Modes of the S7-400H 6-5

6.3 Operating Modes of the CPUs 6-6

6.4 Self-test 6-12

6.5 Time Response 6-16

6.6 Evaluation of process alarms in the S7-400H System 6-16

6.1

Introduction

The S7-400H consists of two redundant configured subsystems that are synchronized via fiber-optic cables.

The two subsystems create a redundant programmable logic controller operating with a two-channel (1-out-of-2) structure on the “active redundancy” principle.

What does active redundancy mean?

Active redundancy, commonly also referred to as functional redundancy, means that all redundant resources are constantly in operation and simultaneously involved in the execution of the control task.

To the S7-400H this implies that the user programs in both CPUs are identical and executed synchronously by the CPUs.

Agreement

To distinguish between both units, we use the traditional expressions of “master” and “standby” for dual-channel redundant systems in this description. The standby always processes events in synchronism with the master, and does not explicitly wait for any errors before doing so.

The distinction made between the master and standby CPUs is primarily important for ensuring reproducible error reactions. Hence, the standby CPU may go into STOP when the redundant coupling fails, while the master CPU remains in RUN.

Master/standby assignment

When the S7-400H is initially switched on, the first CPU to be started assumes master mode, and the partner CPU assumes standby mode.

This master/standby setting is then retained when both CPUs simultaneously POWER ON.

This master/standby setting changes when:

1. The standby CPU starts up before the master CPU (interval of at least 3 s) 2. The redundant master CPU fails or goes into STOP

Synchronizing the units

The master and standby CPUs are coupled by means of fiber-optic cables. The redundant CPUs maintain event-driven synchronous program execution via this coupling.

Subsystem

(CPU0) Synchronization

Subsystem (CPU1)

Figure 6-1 Synchronizing the subsystems

Synchronization is performed automatically by the operating system and has no effect on the user program. You create your program in the manner in which you are accustomed for standard CPUs on the S7-400.

Event-driven synchronization procedure

The “event-driven synchronization” procedure patented by Siemens has been used on the S7-400H. This procedure has proved itself in practice and has already been used for the S5-115H and S5-155H PLCs.

Event-driven synchronization means, that the master and standby units always synchronize their data when an event occurs which may lead to different internal states of the units.

The master and standby CPUs are synchronized upon: • direct access to the I/O

• interrupts

• updating of user times -- for example, S7 timers • modification of data by communication functions

Bumpless continuation of operation in case of redundancy loss at a CPU

The event-driven synchronization method ensures bumpless continuation of operations by the standby CPU even in the event of a master failure.

Self-test

Malfunctions have to be detected, isolated and reported as quickly as possible. Consequently, wide-ranging self-test functions have been implemented in the S7-400H that run automatically and entirely in the background.

The following components and functions are tested: • interconnection of the CPUs

• processor

• Internal memory of the CPU • I/O bus

If the self-test detects an error, the redundant system tries to eliminate it or to suppress its effects.