EMERSONDeltaV™ Controller Redundancy

„ Uninterrupted control operation „ Online upgradeable „ Automatic commissioning „ Bumpless transition

Introduction Now you don’t have to worry about a controller hardware failure interrupting your process and causing costly downtime. Using a redundant controller, your process is automatically protected in case of a hardware failure. If an active controller fails, the standby controller takes over automatically, providing uninterrupted control operation without initialization or user intervention. The switchover generates no disturbances to the field output signals, so your process continues to run without impact. There is no special cabling or configuration required to add redundancy, simply add a controller to your existing hardware. Redundant controllers also support the upgrade of controller firmware and hardware online. You can therefore upgrade your MD Plus to an MQ or MX or your SD Plus to an SQ or SX controller online, with no configuration changes.

Benefits Uninterrupted control operation. By installing redundant M-Series, S-Series and PK controllers, you can establish a “safety net” to protect your process from unexpected controller failures. The standby controller stands ready to maintain control and process uptime in the face of hardware failures. Online Upgrades. Installing redundant DeltaV controllers enables you to perform online upgrades to your DeltaV system. New firmware can be installed in the standby controller while online without affecting operation. Once upgraded, the standby is automatically configured and becomes available, allowing a switchover to the new firmware without disrupting the process. Once the switchover is complete, the original active controller can then be upgraded. In addition, an MQ controller can be upgraded online to an MX controller, and an SQ controller can be upgraded online to an SX controller. This ensures your system is always ready to expand as your control strategy grows. Automatic commissioning. The system automatically detects, commissions, and downloads a standby controller so you can safely replace a unit in the field. Redundancy can be added online by simply installing a new 2-wide backplane with a system power supply and MQ, MX, SQ, or SX controller on it

The SZ controller carrier, or the Dual Universal Safety Carrier, provides 2 slots for SZ controllers, so there is nothing to add other than the additional SZ controller. The PK controller carrier also provides 2 slots, so simply add an additional PK controller to the existing carrier. The engineering database is updated automatically, simply assign and download the controller redundancy license to activate the standby controller, all with no impact to your running process. There are no dip-switches, jumpers or addresses to assign. The standby controller is automatically assigned the appropriate standby address and begins working, protecting your process. Bumpless transition. DeltaV controllers are designed for a bumpless transfer of control from the active controller to the standby controller. During this time, output channels hold their output states until the switchover is complete and control modules begin executing. The control module uses signal status to ensure all I/O channels are good before taking control action on them, and all output signals are synchronized through I/O readback features to ensure control calculations are based on current output states. This ensures a bumpless transfer of control during the switchover when using CHARM or DeltaV Classic I/O cards, with or without Foundation™ fieldbus devices

Product Description For critical process control applications where you can’t afford interruptions, the DeltaV system offers controller redundancy. The standby controller contains the same control strategies as the active controller and the redundancy link transfers control parameters to the standby controller to ensure it is ready to take control if needed. With redundancy enabled, each module will calculate the required updates for the Standby controller when it executes. These updates are transferred to the standby controller over the redundancy link. These additional operations for controller redundancy will typically reduce your CPU free time by approximately 10%. When a fault is detected, the standby controller can take over without bumping the process control signals. The DeltaV Event Chronicle stores a record of each switchover and the reason it occurred (if the reason has been identified). Replacing an existing standby controller is as simple as removing the existing unit and installing a new controller. The active controller will detect the standby and the system will automatically commission and download the new hardware. A redundancy license is required in addition to the redundant hardware. The redundant controller appears in the Explorer window as a single node, indicated by a redundant controller icon.

Switchover Detection The redundant controllers continuously monitor themselves and each other for conditions that require a switchover. Each controller runs continuous self-test routines to determine their ability to function. A hard failure of the active controller will trigger an immediate switchover to the standby controller. The standby controller also monitors the I/O bus traffic to detect if the active controller stops functioning and failed to issue a switchover command. This switchover requires a verification cycle, during which time all output signals hold their values until the new active controller begins executing control strategies. Some of the events that can cause a switchover are: „ Hardware failure within the active controller „ Communications failure between the active controller and I/O „ Communications failure on both control network ports of the active controller „ Removal of the active controller from the carrier „ User request initiated from Diagnostic Explorer