ABB AC 800M Controller Hardware PM866

PM891 Processor Unit – General

PM891 is a high performance controller, which is capable of handling applications with high requirements.

PM891 connects to the S800 I/O system through the optical Modulebus. It can act as a stand-alone Process Controller, or as a controller performing local control tasks in a control network.

Two PM891 controllers can function together as a redundant pair, with one PM891 acting as the primary controller and the other acting as the backup. The backup controller takes over the process controller tasks if any hardware error occurs in the primary controller.

The control network connectivity is obtained by two built in IEEE802.3 Ethernet channels on PM891.

PM891 also provides a communication expansion bus (CEX-Bus) to which a number of expansion modules can be connected. These modules offers connectivity to a wide range of field bus and I/O systems. In case of a redundant pair, both PM891s are connected to the same CEX-Bus and one of them can control the modules.

Physically, the PM891 Processor Unit consists of: 

 • Connector for power supply and status signals (L+, L-, SA, SB).

 • DB25 connector for Electrical CEX-Bus.

• External battery connector. 

 • RJ45 connectors for the two Ethernet channels. 

 • One C om p ort . 

 • Optical Modulebus connector for connection to a maximum of seven clusters, with 12 non-redundant or six redundant modules (that is, 7x12 = 84 modules). 

 • Connectors for Redundancy Link. 

 • SD (Secure Digital) memory connector. 

 • LEDs. 

 • Pushbutton reset switch.

PM891/PM86x/TP830 Processor Unit – Redundancy

Processor unit redundancy is available for PM861, PM864, PM865, PM866, and PM891. In this case, the controller contains two processor units, each including memory for system and application software. One unit is acting as primary, the other is backup (hot stand-by). The primary processor unit controls the process. The backup stands by, ready to take over in case of a fault in the primary. The changeover is done bumplessly and in less than 10 ms. During the changeover, the process outputs are frozen.

Following a changeover, the system operates as a system without redundancy with only one processor unit in operation. You can replace the malfunctioning processor unit while the system is running. After the replacement is carried out, the system once again has a redundant processor unit.

If an error arises in the backup unit, you can also replace the backup unit while the system is running.

Errors which occur in the backup unit can never affect the primary unit's operation. The primary unit and the backup unit are logically separated from one another. Hardware errors in the primary processor unit cause the system to perform a correct changeover. These hardware errors are single errors.

The application programming and the communication are totally unaffected by the redundancy.

PM86x/TP830 Redundancy

The serial port, COM3 on the baseplate TP830, cannot be used in redundant CPU configuration.

The PM861/PM864/PM865/PM866 has an RCU Link Connector for connecting the RCU Link Cable (see Figure 2 on page 32). In a redundant system the two processor units are linked together with the RCU Link Cable (max 1 m). Both processor units are also connected to the same CEX-Bus and either of the two can control the expansion units (see Figure 29 on page 93).

S800 I/O units are connected to the two CPUs via the optical ModuleBus and two TB840 cluster modems on each S800 I/O cluster (see Figure 55 on page 161). The built-in electrical ModuleBus on the TP830 baseplate cannot be used for connecting S800 I/O in a redundant system.

PM891 Redundancy

The Redundancy Link in PM891 consists of two physical links. These are the 

 RCU Data Link and the RCU Control Link. The RCU Data Link is a fast communication channel used to transfer the data required to keep the backup CPU synchronized with the primary CPU. 

 TK855 RCU Data Link Cable is used for the data link. The RCU Control Link is used for role selection and CPU identity assignment (UPPER/LOWER). 

 TK856 RCU Control Link Cable is used for the control link.

Fault Tolerance Principle

The principle of fault tolerance in the redundant processor units is based on continuous updating of the backup unit to the same status as the primary unit. This enables the backup unit to assume control without affecting surrounding systems in a bumpless manner. This principle involves dynamic division of the program execution into execution units and the creation of rollback points at which the processor unit's status is completely defined. In this context, the processor unit's total status is defined as the processor unit's internal status, that is, the contents of the processor registers, plus the contents of the data memory. The backup unit's status is updated each time the primary unit passes a rollback point, enabling the backup unit to resume program execution from the last rollback point passed, should the primary unit fail due to error. In order to minimize the amount of information involved in the update, the backup unit is updated only with the changes taking place since the latest rollback point. Between rollback points, these changes that writes in the data memory, are stored in a log buffer in the backup unit. At a rollback point, the processor's total register contents are also written into the data memory, so that this information is also logged. Once the rollback point is established, the logged write operations are transferred to the backup unit's data memory.