The redundancy status in the web browser shows the vitality status of the systems and the status of the networks between the visualization and the computers as well as between the computers themselves.

© Certec

With 'Atvise' from version 3.0, redundancy between two servers can now be configured. There is one operational and one non-operational server. These communicate with each other via a redundant connection. The active server manages the operation and is basically the leading server via which the system is visualized. The passive server runs in parallel, takes over current process data and its status from the active server and also buffers information from the data sources, which it does not transfer to the process image as long as the system is in a normal state. In the event of a fail-over, i.e. the total failure of the operating server, no data is lost as the passive server can now access the buffered data from the data sources.

The engineering tool: The 'Atvise' builder with redundancy status display offers a graphical drawing interface for adapting the visualization as well as corresponding parameterization options.

© Certec

Structural changes are also transferred during the ongoing synchronization of changes in the process image between the servers. This means, for example, that if a data point is created in the 'Atvise' builder - the engineering tool - on the active server, this change is synchronized and adopted by the passive server.

The system monitors the 'health status' of both computers and all their connections and displays the actual status via the vital status. The evaluation of the vital status can be configured and parameterized in the 'Atvise' builder using a variety of criteria such as network status, CPU speed or memory performance (e.g. limit values or weighting). If you now want to manually intervene in the redundancy and change the operating server, a so-called switch-over is initiated, which is implemented on the condition that both servers have the same vital status. This is also decisive for a switch between the computers, because if the vitality status of a server deteriorates, a fail-over is initiated. Conversely, the system switches back to the original state if the vitality status of the originally operating computer has improved again. The most malicious form of fail-over is the complete failure of the operating server. If this occurs, the investment in redundancy has already paid for itself.

Operating modes for all situations

The 'Atvise' redundancy distinguishes between two operating modes: one according to the described redundancy mode and a so-called split mode. The latter is initiated manually by the user. During this state, there is virtually no communication between the servers - apart from 'keep-alive', status and preferred position. This means that there is also no synchronization of the process image between the servers. At the moment of separation, the originally active server assumes the status of SOP (Split Operational) and remains the operating computer, while the previously passive server now becomes SNOP (Split Non-Operational) and has no influence. In split operation, the status of the servers can be changed, i.e. SOP becomes SNOP and vice versa.

Split mode is used for maintenance purposes on one of the servers. In this operating mode, both servers act independently and do not influence each other, as redundant operation is canceled. This means that you can continue to operate your system with the operating server, which still has the old version of the application, while hardware replacement or major changes to the application can be carried out on the non-operating server, for example. During the transition to redundant operation, which is also initiated manually, the two computers are synchronized again and the application changes, including the current process image, are transferred to the second computer.

The requirements

Many basic requirements were necessary to successfully implement this redundancy: among other things, the kernel was trimmed in the direction of 'Threading Building Blocks' (Intel TBB) in order to achieve a scalable, improved use of the available resources such as processors and cores. The purpose of this measure is also to increase performance.

Next, the developers turned their attention to revising the history module - a key issue in terms of reliability. This is because loss-free, automatic synchronization of online/historical data during operation and also after a switch-over or failure must be guaranteed. This also led to an optimization of the 'Atvise' history screen.

The focus then shifted to the data sources. Here it was also necessary to get a handle on those that are redundant. In addition, each data source can also be equipped with a redundant network connection. Communication with redundant data sources can take place via OPC UA and OPC Classic. This is because OPC UA is always the first choice for 'Atvise' products, and has been since the very beginning. This feature is also available in stand-alone operation with 'Atvise 3.0'.

Finally, the developers integrated the latest OPC UA SDK and an update of the internal libraries such as QT 5 or OpenSSL. The latest version also supports the SNMP V1/V2C communication protocol, including the calculation and linking of OIDs (object identifiers). SNMP is the basis for network management and enables the monitoring and control of network elements such as routers, servers and switches.

First applications being implemented

In the meantime, a lot has happened in terms of sales: when Certec started developing redundancy, there was great demand to implement this type of SCADA solution for infrastructure projects such as water/wastewater. Since then, there have been many inquiries from other different industrial segments such as logistics, oil and gas, marine and the automotive industry.

"The interest in the world's first SCADA solution with hot standby redundancy in pure web technology is greater than expected," says Certec Managing Director Leopold Matouschek. "The first applications are already being implemented and will probably go live in the fourth quarter. Reports on this will follow."

Author:
Ronald Düker is Head of Marketing/Product Marketing at Certec.