490NTW00080U模块备件

CI873和TP867-以太网/IP接口
螺钉端子用于连接电源和外部
电池
24 V直流电源为CEX总线上的所有单元供电。光学
模块集群独立供电。
图9.PM891顶视图
安全数字（SD）插槽初始化
RCU数据链路RCU控制链路
按钮
1节介绍PM891处理器单元——概述
3BSE036351-510 A 43
冗余链路由两条电缆组成；RCU数据链路电缆和RCU
控制链路电缆（见图9）。
图11显示了PM891的框图。
图10.PM891-带有Tx1/Rx1和CN1/CN2端口的底视图。
PM891处理器单元-概述1节介绍
44 3BSE036351-510 A
图11.PM891的框图
1节介绍PM891处理器单元——概述
3BSE036351-510 A 45
图12.带有单个PM891的AC 800M/S800 I/O互连配置
注1-多7个集群x 12=84个模块。集群之间的大距离为200米。
注2-远程S800输入/输出。多24个模块/站（12个/集群），
24 x 32=每段768个模块。
（仅适用于PM851的1个群集）限制适用，请参阅I/O文档。
附加站
多
每个32个站
中继器
TB820
CI801
TB820
至6个附加光学元件
模块总线集群
视力的
R段
单元
视力的
视力的
CI854A
见注1
见注2
1段
现场总线DP
（非PM851）
注3-PM851多一个CEX模块。
见附注3
PM891
PM891处理器单元-概述1节介绍
46 3BSE036351-510 A
图13.AC 800M/S800 I/O和基金会现场总线高速示例
单PM891配置中的以太网互连
PM891
中央处理器
CI860和CI854A
TB820 DI810 AI810 AO820
至6个附加光学元件
每个集群多12个模块
模块总线集群
看见
注1
看见
注2
注3——例如，基金会现场总线
视力的
视力的
现场总线DP
多12个单位
基础
现场总线HSE
LD 800HSE
见附注3
高速以太网
基金会现场总线H1链路
1…4链接
FF场
装置
1至4链路基金会现场总线H1
FF场
装置
FF场
装置
HSE
装置
注1–多7个集群（PM851的1个光学集群）。
注2–中央S800输入/输出。多96个单位。
集群之间的大距离为200米。
适用的限制，请参阅I/O文档。
连接装置LD 800HSE
LD 800HSE
见附注3
1节介绍PM891/PM86x/TP830处理器单元——冗余
3BSE036351-510 A 47
PM891/PM86x/TP830处理器单元-冗余
处理器单元冗余可用于PM861、PM864、PM865、PM866和
在这种情况下，控制器包含两个处理器单元，每个处理器单元包括：
系统和应用软件的内存。一个单元作为主要单元，即
另一种是备份（热备用）。主处理器单元控制该过程。这个
备用设备随时待命，准备在主设备出现故障时接管。这个
转换在不到10毫秒的时间内顺利完成。在转换过程中
过程输出被冻结。
转换后，系统作为一个无冗余的系统运行，具有：
只有一个处理器单元在运行。您可以更换出现故障的处理器
系统运行时的单位。更换后，系统
再次具有冗余处理器单元。
如果备份单元出现错误，您也可以在
系统正在运行。
备份单元中发生的错误永远不会影响主单元的操作。
主单元和备用单元在逻辑上彼此分离。
主处理器单元中的硬件错误导致系统执行正确的
转换。这些硬件错误是单个错误。
应用程序编程和通信完全不受
冗余
PM86x/TP830冗余
PM861/PM864/PM865/PM866具有一个RCU链路连接器，用于连接
RCU链路电缆（参见32页图2）。在冗余系统中，两个处理器
单元通过RCU链路电缆（大1米）连接在一起。两个处理器单元
也连接到相同的CEX总线，并且两个总线中的任何一个都可以控制
膨胀装置（参见93页图29）。
S800 I/O单元通过光学模块总线和两个
每个S800 I/O集群上的TB840集群调制解调器（参见161页的图55）。这个
TP830基板上的内置电气模块总线不能用于连接
冗余系统中的S800 I/O。
底板TP830上的串行端口COM3不能用于冗余CPU
配置
PM891/PM86x/TP830处理器单元-冗余1节介绍
48 3BSE036351-510 A
PM891冗余
PM891中的冗余链路由两个物理链路组成。这些是
RCU数据链路和RCU控制链路。
RCU数据链路是用于传输数据的快速通信信道
需要保持备份CPU与主CPU同步。
TK855 RCU数据链路电缆用于数据链路。
RCU控制链路用于角色选择和CPU标识分配
（上/下）。
TK856 RCU控制链路电缆用于控制链路。
容错原理
普林Screw terminals are provided for connections to the power supply and the external
battery.
The 24 V DC power supply powers all the units on the CEX-Bus. The optical
module clusters are powered independently.
Figure 9. PM891-Top view
Secure Digital (SD) slot INIT
RCU Data Link RCU Control Link
button
Section 1 Introduction PM891 Processor Unit – General
3BSE036351-510 A 43
The Redundancy Link consists of two cables; RCU Data Link Cable and RCU
Control Link Cable (see Figure 9).
Figure 11 shows the block diagram of PM891.
Figure 10. PM891 - Bottom view with Tx1/Rx1 and CN1/CN2 ports.
PM891 Processor Unit – General Section 1 Introduction
44 3BSE036351-510 A
Figure 11. Block diagram of PM891
Section 1 Introduction PM891 Processor Unit – General
3BSE036351-510 A 45
Figure 12. AC 800M/S800 I/O Interconnection Configuration with single PM891
Note1 - Maximum 7 clusters x 12 = 84 modules. Max 200 m between clusters.
Note 2 - Remote S800 I/O. Maximum 24 modules/station (12/cluster),
24 x 32 =768 modules per segment.
(1 cluster only for PM851)Restrictions apply, see I/O documentation.
Additional stations
up to maximum of
32 stations per
Repeater
TB820
CI801
TB820
To 6 Additional Optical
Modulebus Clusters
Optical
Segment R
Unit
Optical
Optical
CI854A
See Note 1
See Note 2
1 Segment of
PROFIBUS DP
(not PM851)
Note 3 - Maximum one CEX-module for PM851.
See Note 3
PM891
PM891 Processor Unit – General Section 1 Introduction
46 3BSE036351-510 A
Figure 13. Example of AC 800M/S800 I/O and FOUNDATION Fieldbus High Speed
Ethernet Interconnection in Single PM891 Configuration
PM891
CPU
CI860 CI854A
TB820 DI810 AI810 AO820
To 6 Additional Optical
Max 12 Modules per Cluster
Modulebus Clusters
See
Note 1
See
Note 2
Note 3 – For example FOUNDATION Fieldbus
Optical
Optical
PROFIBUS DP
Max 12 units
FOUNDATION
Fieldbus HSE
LD 800HSE
see Note 3
High Speed Ethernet
FOUNDATION Fieldbus H1 Link
1...4 Links
FF Field
Device ...
1 to 4 Links FOUNDATION Fieldbus H1
FF Field
Device
FF Field
Device
HSE
Device
Note 1 – Maximum 7 clusters (1 optical cluster for PM851).
Note 2 – Central S800 I/O. Max. 96 units.
Max 200 m between clusters.
Restrictions apply, see I/O documentation.
Linking Device LD 800HSE
LD 800HSE
see Note 3
Section 1 Introduction PM891/PM86x/TP830 Processor Unit – Redundancy
3BSE036351-510 A 47
PM891/PM86x/TP830 Processor Unit – Redundancy
Processor unit redundancy is available for PM861, PM864, PM865, PM866, and
PM891. In this case, the controller contains two processor units, each including
memory for system and application software. One unit is acting as primary, the
other is backup (hot stand-by). The primary processor unit controls the process. The
backup stands by, ready to take over in case of a fault in the primary. The
changeover is done bumplessly and in less than 10 ms. During the changeover, the
process outputs are frozen.
Following a changeover, the system operates as a system without redundancy with
only one processor unit in operation. You can replace the malfunctioning processor
unit while the system is running. After the replacement is carried out, the system
once again has a redundant processor unit.
If an error arises in the backup unit, you can also replace the backup unit while the
system is running.
Errors which occur in the backup unit can never affect the primary unit's operation.
The primary unit and the backup unit are logically separated from one another.
Hardware errors in the primary processor unit cause the system to perform a correct
changeover. These hardware errors are single errors.
The application programming and the communication are totally unaffected by the
redundancy.
PM86x/TP830 Redundancy
The PM861/PM864/PM865/PM866 has an RCU Link Connector for connecting the
RCU Link Cable (see Figure 2 on page 32). In a redundant system the two processor
units are linked together with the RCU Link Cable (max 1 m). Both processor units
are also connected to the same CEX-Bus and either of the two can control the
expansion units (see Figure 29 on page 93).
S800 I/O units are connected to the two CPUs via the optical ModuleBus and two
TB840 cluster modems on each S800 I/O cluster (see Figure 55 on page 161). The
built-in electrical ModuleBus on the TP830 baseplate cannot be used for connecting
S800 I/O in a redundant system.
The serial port, COM3 on the baseplate TP830, cannot be used in redundant CPU
configuration.
PM891/PM86x/TP830 Processor Unit – Redundancy Section 1 Introduction
48 3BSE036351-510 A
PM891 Redundancy
The Redundancy Link in PM891 consists of two physical links. These are the
RCU Data Link and the RCU Control Link.
The RCU Data Link is a fast communication channel used to transfer the data
required to keep the backup CPU synchronized with the primary CPU.
TK855 RCU Data Link Cable is used for the data link.
The RCU Control Link is used for role selection and CPU identity assignment
(UPPER/LOWER).
TK856 RCU Control Link Cable is used for the control link.
Fault Tolerance Principle
The principle of fault tolerance in the redundant processor units is based on
continuous updating of the backup unit to the same status as the primary unit. This
enables the backup unit to assume control without affecting surrounding systems in
a bumpless manner.
This principle involves dynamic division of the program execution into execution
units and the creation of rollback points at which the processor unit's status is
completely defined.
In this context, the processor unit's total status is defined as the processor unit's
internal status, that is, the contents of the processor registers, plus the contents of the
data memory.
The backup unit's status is updated each time the primary unit passes a rollback
point, enabling the backup unit to resume program execution from the last rollback
point passed, should the primary unit fail due to error.
In order to minimize the amount of information involved in the update, the backup
unit is updated only with the changes taking place since the latest rollback point.
Between rollback points, these changes that writes in the data memory, are stored in
a log buffer in the backup unit. At a rollback point, the processor's total register
contents are also written into the data memory, so that this information is also
logged. Once the rollback point is established, the logged write operations are
transferred to the backup unit's data memory.
Section 1 Introduction PM891/PM86x/TP830 Processor Unit – Redundancy
3BSE036351-510 A 49
If the primary unit fails because of an error, the backup unit resumes execution from
the last rollback point, which means the last execution unit is partially re-executed
by the backup unit. In order to re-execute a portion of the execution unit without
affecting the peripheral units (communication units on the CEX-Bus), the peripheral
units' references are also logged between rollback points. During re-execution, the
results of the peripheral units' references, which have already been executed, are
used, rather than re-executing them. The results of read operations are retrieved
from the log, and write operations pass without execution, since they have already
been executed. The peripheral units' statuses, then, are not affected by the reexecution in any way, except for the time delay which occurs.
The RAM included in the processor unit provides an automatic double inverted
memory function for detection of arbitrary bit errors in the memory.
• All memory updates are written to both the primary memory and to the inverted
memory in parallel.
• At every memory read cycle, the data from tho two memories is compared.
• If there is a mismatch in the data a changeover is forced.
The double inverted memory handling is done in hardware and without any delay to
the memory cycle time.
MAC and IP Address Handling in Redundant Configuration
In order to provide for a bumpless changeover with respect to the control network,
both the MAC and IP addresses are swapped between the initial primary and backup
CPUs. The addresses of the initial primary CPU are stored and kept as the addresses
used by the acting primary CPU. Similarly the addresses of the initial backup CPU
are stored to be used by the acting backup CPU. This means that a redundant
controller will be always identified and recognized by