6. HX3040 Redundancy
280
happen a second failure in the redundant component during the repair of the first failure, which
would undermine the system. Therefore, the longer the time of repair, the lower system
availability.
8.
Schedule periodic offline tests in the components, so as to detect non-diagnosable faults. The
goal is to detect hidden faults, particularly in redundant components (or even in simple ones, as
long they, which are not usually requested, as a safety relay, for example. Sometimes offline tests
involve stops in the system, which reduces availability. Special occasions such as programmed
shutdowns for maintenance, for example, are good opportunities for this procedure. The longer
the period between off-line testing, the longer the time in which a fault may be hidden, and hence
higher the probability of eventual failures compromise the system, decreasing the system
availability.
HX3040 CPU accounts for these principles when creating a project of redundant RTUs.
The following subsections analyze different types of faults and the tolerance to them, as well as the
possibility of switchovers.
Simple Failure with Unavailability
As some components are not duplicated, they cannot support even single failure without causing
some kind of unavailability. The redundant RTU with CPU HX3040 manage the following
components:
I/O Modules
Racks (HX9001 or HX9003)
The unavailability of an I/O module does not undermine the whole system availability. It constitutes
in a partial unavailability, regarding the control loops, which use this given I/O module.
Although there is no projection of I/O modules redundancy, the user application can manage it in
special cases. For example, the user can enter three modules of different analog inputs, and
implement a voting scheme between trios of analog inputs to any critical system. However, such
solutions, as emphasized, should be managed by the user. There is no automated support for it. Such
solutions generally involve also the redundancy in the field transducers and actuators.
Simple Failure without Unavailability Causing a Switchover
Redundant HX3040 CPUs may support single failures without causing unavailability, but they do
cause switchovers.
Single Failure without Unavailability
HX8300 and HX8320 redundant power supplies support single failures without causing
unavailability but doing a switchover.
Redundancy Overhead
Redundant applications demand a higher processing time when compared to an equivalent non-
redundant application.
This additional time is mainly due to the implementation of the cyclic synchronization services (see
Cyclic Synchronization Services through Redundancy Synchronism Channels), plus the short time
destined to its own redundancy management (state machine, etc.). MasterTool estimates the total
additional time (redundancy overhead) and displays it in the Messages window, after it builds the
project of the redundant CPU.
The time for data transfer depends on the amount of data and follows a ratio of approximately 6.4 ms
for each 100KB of data. To calculate the maximum effective transfer time, it estimates a minimum
time of 7ms (constant) and calculates the remainder by using the total amount of data (including the
117.000 bytes event queue). Thus, typically an empty redundant application presents a maximum
