4 |
Power Supply
The power supply has adequate internal fault detection which will cause it to automatically shut down if there is a failure. In an orderly shut down, the power supply will first assert the ACFAIL signal before it asserts the SYSREST signal. This will give the active PLC time to notify the backup PLC that it can no longer control the process.
A power supply failure will be indicated by the absence of the OK indication at the powe supply. There are a small number of failures that can result in a false indication or no indication. The probability of these occurring are extremely low compared to the major failure items of the power supply.
In the event of a power supply failure, the backup CPU takes control of the system. The power supply can be replaced with power removed from its rack without interruption to the application being controlled. When the power supply is replaced, power can be returned to the rack and the CPU will then obtain synchronization with the active system and either take control or become the backup CPU.
Racks
The only detectable rack failure is bad data across the backplane. This bad data can take the form of a bad control line as well as a bad data or address line. In most cases bad data lines will be detected by the data integrity checks associated with the data transfers. If these occur the system will be faulted and control transferred to the backup unit. An indication will be given that a data transfer error has occurred.
There is no single indication that a rack failure has occurred. The rack is a very reliable component in the system and rack failures are extremely rare. A rack failure (other than a catastrophic rack failure) will only be correctly diagnosed by process of elimination.
In the unlikely event that a rack failure does occur and is correctly diagnosed, the rack can be replaced with power removed from the system. When the rack is replaced and power restored to the system, the CPU will then obtain synchronization with the active system and either take control or become the backup CPU.
Central Processor Unit
If the CPU 780 fails, the OK light on the CPU will be out or blinking. In addition, fault information will be available in the Fault Table of one or both CPU's.
In the event of a CPU failure control is transferred to the backup system. CPU replacement can be accomplished by removing power from the rack and replacing the CPU. When power is returned to the system, the program can be loaded into the CPU and the CPU started. It will then obtain synchronization with the active system and either take control or become the backup CPU.
Redundancy Communications Module and Cables
If a fault is detected in a single RCM or in its terminated I/O cable, the backup RCM will be used. Control will not transfer to the backup CPU. An RCM fault will be logged in the PLC Fault Tables of both PLCs. The loss of an RCM is not fatal. If there are expansion racks within a system, and the cable fault is such that the system can no longer communicate to the expansion racks, then the fault is fatal and the PLC will be halted. Control will then transfer to the backup PLC.
Chapter 4 Operation | 81 |