S7-400H Redundancy

S7-400H How it works and its redundancy principles.

In many areas of automation technology, there is a continually increasing demand for the availability and thus the fail-safety of the automation systems. There are areas where a plant standstill can result in extremely high costs. Here, only redundant systems can do justice to the availability requirements. The high-availability SIMATIC S7-400H meets these requirements. It continues to operate even when parts of the controller have failed due to one or more faults. The availability thus achieved makes the SIMATIC S7-400H especially suitable for the following application areas:

Processes with high restart costs following a controller failure.

Processes with expensive standstill times.

Processes involving valuable materials.

Processes in which no data must be lost in the event of an error.

Unsupervised applications

Applications with reduced maintenance personnel.

S7-400H Redundancy Principle

The S7-400H works according to the principle of active redundancy in “hot standby” mode (reaction-free automatic switchover in the event of a fault). According to this principle, both subunits are active during fault-free operation. In the event of a fault, the intact device assumes control of the process alone.

To guarantee this transfer bumplessly, fast and reliable data exchange via the central controller link is required.
In the course of the failover, the devices automatically retain

the same user program

the same data blocks

the same process image contents

the same internal data such as timers, counters, bit memories, etc.

This means both devices are always completely up-to-date and can continue control alone in the event of a fault.
For redundant operation of the I/O this results in the following:

During fault-free operation, both modules are active, that is, in the case of redundant inputs, for example, the shared sensor (two sensors are also possible) is read in via two modules, and the results are compared and made available to the user as a unified value for further processing. In the case of redundant outputs, the value calculated by the user program is output by both modules.

In the event of a fault, e.g. the failure of one or both of the input modules, the defective module is no longer addressed, the fault is reported, and operation continues with the intact module only. Following the repair, which can take place online, both modules are addressed again.