View Site Edition Server Redundancy Guidelines SE V5.0(CPR7)Server Redundancy... · FTView SE 5.0...

FactoryTalk

View Site Edition

V5.0 (CPR9)

Server Redundancy

Guidelines

FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 of 27

This page left intentionally blank.


Table of Contents

Introduction ......................................................................................................................................................4

Redundancy enhancements in CPR9 ...............................................................................................................5

Configuration & Operation & Tips ..................................................................................................................9

Terminology.................................................................................................................................................9

Redundant System Topologies...................................................................................................................10

Revision Maintenance of FactoryTalk View SE........................................................................................11

Setting up a Redundant FactoryTalk View SE System..............................................................................11

Starting a Redundant FactoryTalk View SE System .................................................................................21

References ......................................................................................................................................................27


Introduction This document serves as a supplement to Chapter 14: ‘Setting up FactoryTalk system availability’ in the FactoryTalk

View Site Edition User's Guide Volume 1 (Aug 2007). Its purpose is to:

• introduce the new redundancy features of CPR9 (Aug 2007)

• provide supplemental Configuration, Operation and Troubleshooting tips for redundant SE 5.0 systems

The User’s Guide is considered prerequisite reading for this document.


Redundancy enhancements in CPR9

The following enhancements can be found in CPR9:

• Server Status dialog – shows the current server status and allows manual switchover of servers.


• Favor current switchback option for HMI Servers – allows clients to continue using the secondary HMI

Server when the primary HMI Server becomes available.


• New Display Client Object Model GetServerState method, ServerStateChanged event and

gfxServerStateConstants.


• Health Monitoring parameters – application wide settings to tune the application accommodate network

issues. Changes to these settings are NOT recommended unless directed by Technical Support personnel.


Configuration & Operation & Tips

Terminology

The following terms are used in this document. When the term is used, its meaning is as follows:

Active server The server in a redundant server pair that is actively providing service to client computers. New clients can connect to the Active server.

Alarm state synchronization HMI servers in a redundant server pair keep alarm information synchronized between the two server computers. This occurs via alarm state synchronization.

Controlled switchover User-initiated switch of Active server from currently active to the Standby server in the redundant pair.

Fail-over The Active server fails and the Standby server becomes the Active server. Clients connected to the failed server will automatically reconnect to the new Active server.

FavorCurrent The server setting “Continue using the secondary server even when the primary server becomes available again” that specifies that an Active secondary server will remain active after the primary server in the redundant pair is brought online and that the primary server will become the Standby server.

This is the default setting for all new servers.

FavorPrimary The server setting “Switch over to the primary server when it becomes available” that specifies the primary server will become active whenever it is ready to provide service. If the secondary server is running as the Active server when the primary is brought online, the secondary will become standby and all connected clients will automatically reconnect to the Active primary server.

This is the default setting for all HMI servers created in RSView SE 4.00 or earlier.

HMI switchback delay When a (pre-CPR9) primary HMI server comes back online after a failure or shutdown, there is a configurable delay to allow alarm state synchronization to occur before clients can connect to the (pre-CPR9) primary server. The default is two minutes and can be configured through a policy setting.

Host computer The physical computer that runs the server.

Logical server A server instance that runs a server configuration.

Network disconnect A loss of communication between the host computer and the network of five seconds or greater.

Network glitch A network glitch is a temporary server disconnect from the network or the inability of the server to talk to the other nodes in the distributed application due to noise, network switch reset/reconfiguration or fluctuations in network traffic.

On active macro The On active macro is run when an HMI server transitions to active mode, either on boot or from standby mode. The commands in the On active macro should include components that should only be run when an HMI server is active. Examples of services that should be run when a server becomes active include: data logging, derived tags and event detector.


On standby macro The On standby macro is run when an HMI server transitions to standby mode, either on boot or from active mode. The commands in the On standby macro should include components that should only be run when an HMI server is standby or shutting down services that are active server components. Examples of services that should be shut down when a server becomes standby include: data logging, derived tags and event detector.

Partner server The server associated with a given server in a redundant server pair.

Primary server The server in the redundant server pair that will normally be the Active server.

Redundant server pair A pair of identically configured logical servers running on different host computers that act together to provide clients with fault-tolerant service. If one server in the pair fails, the other server will automatically take its place to ensure that service to clients is not lost.

Secondary server The server in the redundant server pair that will normally be the Standby server.

ServerPing Determines the status of all the software and hardware in a distributed SE application

Standby server The server in a redundant server pair that is waiting to provide service to client computers in the event the Active server fails. New clients will not connect to the Standby server.

Switchback The activity of automatically switching from an Active Secondary to the Primary server when the primary comes into service. This occurs for servers that are configured to switch back to the primary server when it becomes available

Switchover The activity of switching the current Active server to the Standby server. The Standby server becomes the Active server and the former Active server becomes the Standby. This can occur automatically when the server is configured as FavorPrimary or through the controlled switchover mechanism when the server is configured as FavorCurrent.

Reboot Whenever this document refers to rebooting a server computer, it is recommended that a Windows shutdown is performed. Once the machine is shut down, then the computer should be powered back on. This ensures that Windows does not hold on to incorrect information in memory.

Redundant System Topologies

Refer to ‘Planning the layout of a redundant system’ in Chapter 14 in the FactoryTalk View Site Edition User's

Guide for guidelines and limits of a redundant architecture. Be sure to consider CPU loading factors and server

activity when creating your redundant system architecture.


Revision Maintenance of FactoryTalk View SE

In a distributed FactoryTalk View SE system, it is critical that all computers have the same version of the software

(including post-release patches). Prior to configuring redundancy, you should update all FactoryTalk View SE

computers up with the latest patches and verify that all computers are at the same level. See AID 37313 –

FactoryTalk View Site Edition 5.00.00 (CPR9) Patch TOC.

Setting up a Redundant FactoryTalk View SE System

The following sections provide additional detail to the FactoryTalk View Site Edition User's Guide section entitled

“Setting up FactoryTalk system availability” on page 14-1. Prior to completing the steps below, you must have

already created your FactoryTalk Application and HMI project(s) and Data Server(s). For details, refer to the

FactoryTalk View Site Edition User's Guide, Chapter 6: Working with network applications.

Configuring a Redundant HMI Server

The steps that should be performed to configure a redundant HMI server are as follows:

1. Copy the HMI project files from the primary HMI Server to the identical location on the designated

secondary HMI Server. The utility in AID 30310 – RSView SE - Backup and Restore Utility for HMI Server

can be used to copy HMI project files.

Note: The Replicate button can only be used to synchronize HMI project files after redundancy has been

setup.

2. Launch FactoryTalk View Studio.

Note: FactoryTalk View Studio may be launched on the primary HMI Server, secondary HMI Server, or

virtually any remote computer that uses the same FactoryTalk Directory as the HMI Servers.

3. In the Product Type Selection dialog, select Site Edtion (Network) and click Continue. You may be

prompted to Log On to FactoryTalk.

Note: If you are not prompted to log on, then FactoryTalk’s Single Sign-on feature is enabled and

configured. For more information on FactoryTalk Security, please refer to the FactoryTalk View SE User's

Guide, Chapter 5: Setting up security.

4. Log On to FactoryTalk as an administrator (if required).

5. In New/Open Site Edition (Network) Application dialog:

• select the Existing tab

• select your Application

• select your Language

• click Open.


6. When your application has opened, right click on the HMI server you want to make

redundant and select Properties… The HMI Server Properties page for the selected HMI server will open.

7. On the HMI Server Properties General tab, change the Startup type to Load and run startup components

when operating system initializes (Redundancy cannot be configured if this option is set to On demand):

8. Click Apply to save the Startup type setting.

9. Select the Redundancy tab and click the Provide redundancy using a secondary server checkbox to turn

redundancy on for the selected HMI server. In the Computer hosting the secondary server field, enter (or

browse for) the name of the computer that will host the secondary server:


Note: The default Switch back option for newly created HMI Servers is Continue using the secondary

server... . This means that when your primary server fails or is shutdown, the secondary server will become

the active server. When your primary server comes back online, the secondary HMI Server will continue to

function as your HMI Server and clients will remain connected to the secondary. When Continue using the

secondary server is selected, you must either manually switch the active server (from the Server Status

dialog) or shutdown the secondary server computer to switch from the secondary back to the primary as the

active HMI Server. Selecting the Switchback to primary server option means that when the primary server

comes back online, the primary will automatically become active and the switchback from the secondary

server will occur without user intervention. This is the default setting for HMI Servers created with RSView

SE 4.0 or earlier.

10. Click Apply to verify the HMI Server configuration on the computer hosting the secondary HMI Server.

11. Click on OK and the secondary HMI Server will be loaded, alarming will be synchronized and will then

become the standby server.


12. Right click on the redundant HMI server and select Properties… The HMI Server

Properties page for the selected HMI server will open. Select the Components tab and configure your On

startup components.

Note: In a non-redundant system, enabled On startup components would typically include Alarming, Data

logging, Derived tags and Events. However, in a redundant system, Alarming is the typically the only

component that runs on both the Active and Standby servers. The remaining components are typically

running only on the Active server and are therefore started in the On active macro and stopped in the On

standby macro. Only components that should be running on both the Active and Standby servers should be

configured in the On startup components.

13. Configure an On active macro for commands that should be run when the server becomes Active (this

includes startup).

Note: If you have checked the ‘Alarming’ checkbox, you do not need to place the ‘AlarmOn’ command in

the On active macro.

14. Configure an On standby macro for commands that should be run when the server becomes Standby.


15. Click Apply to save the changes to your HMI Server Components configuration.

16. Return to the Redundancy tab and click Replicate Primary to Secondary… Read the information

provided and click Yes to continue. This will transfer the Components configuration you just completed to

the secondary HMI computer and verify that the setup is correct and that the replication feature is working

properly.


Configuring a Redundant RSLinx Enterprise Data Server The steps that should be performed to configure a redundant RSLinx Enterprise Server are as follows:


Note: FactoryTalk View Studio may be launched on the primary Data Server, secondary Data Server, or

virtually any remote computer that uses the same FactoryTalk Directory as the RSLinx Enterprise Data

Servers.

17. In the Product Type Selection dialog, select Site Edtion (Network) and click Continue. You may be

prompted to Log On to FactoryTalk.


configured. For more information on FactoryTalk Security, please refer to the FactoryTalk View Site

Edition User's Guide, Chapter 5: Setting up security.


3. When your application has opened, right click on the RSLinx Enterprise data server you want to make a

redundant server and select Properties… and the RSLinx Enterprise Server Properties page for the selected

RSLinx Enterprise server will open.

4. Select the Redundancy tab to configure a secondary RSLinx Enterprise data server.

5. Click the Provide redundancy using a secondary server checkbox to turn redundancy on for the selected

RSLinx Enterprise server. In the Computer hosting the secondary server field, enter the name of the

computer that will host the secondary server:


Note: The default Switch back option is Continue using the secondary server... This means that when

your primary server fails or is shutdown, the secondary server will become the active server. When your

primary server comes back online, the secondary RSLinx Enterprise Data Server will continue to function as

your active data server and clients will remain connected to the secondary. When Continue using the

secondary server is selected, you must either manually switch the active server (from the Server Status

dialog) or you must shutdown the secondary server computer to switch from the secondary back to the

primary as the active RSLinx Enterprise data server. Selecting the Switchback to primary server option

means that when the primary server comes back online, the primary will automatically become active and the

switchback from the secondary server will occur without user intervention.

6. Click OK to save the changes you have made to the RSLinx Enterprise Server properties and close the

properties dialog.


7. Double-click on the Communication Setup icon in the Application Explorer to launch the

Communication Setup dialog shown below:

8. In the Primary tab, you will have configured the RSLinx Enterprise device shortcuts for your primary server.

Click the Secondary tab and configure the same device shortcut on your secondary computer.

Note: RSLinx Enterprise software must be installed on the secondary Data Server.

9. Click Apply to save the new shortcut then OK to save the Communication Setup information.

Configuring a Redundant OPC Data Server The steps that should be performed to configure a redundant OPC Data Server are as follows:

1. Copy the OPC Data Server project files to the proper location on the designated secondary Data Server. For

details, see “Moving data server files” on page 17-15 of the FactoryTalk View Site Edition User's Guide.


Note: FactoryTalk View Studio may be launched on the primary OPC Data Server, secondary OPC Data

Server, or virtually any remote computer that uses the same FactoryTalk Directory as the OPC Data Server.


3. In the Product Type Selection dialog, select Site Edtion (Network) and click Continue.

You may be prompted to Log On to FactoryTalk.


configured. For more information on FactoryTalk Security, please refer to the FactoryTalk View Site Edition

User's Guide, Chapter 5: Setting up security.


5. When your application has opened, right click on the OPC Data Server you want to make a redundant

server and select Properties… and the OPC Server Properties page for the selected OPC server will open.

6. Select the Redundancy tab to configure a secondary OPC data server.

7. Click the Provide redundancy using a secondary server checkbox to turn redundancy on for the selected OPC

server. In the Computer hosting the secondary server field, enter the name of the computer that will host

the secondary server:

Note: The default Switch back option is Continue using the secondary server… This means that when

your primary server fails or is shutdown, the secondary server will become the active server. When your


primary server comes back online, the secondary OPC data server will continue to function as

your active data server and clients will remain connect to the secondary. When Continue using the

secondary server is selected you must either manually switch the active server (from the Server Status

dialog) or you must shutdown the secondary server computer to switch from the secondary back to the

primary as the active OPC data server. Selecting the Switchback to the primary server when it becomes

available again option means that when the primary server comes back online, the primary will automatically

become active and the switchback from the secondary server will occur without user intervention.

8. Click OK to save the changes you have made to the OPC Data Server properties and close the properties

dialog.

Note: Any subsequent changes to the configuration of RSLinx Classic as the primary Data Server must be

duplicated on the secondary Data Server. This can be accomplished by using the RSLinx Classic GUI locally

on both servers, or by backing up the changes on the primary and restoring them on the secondary.

Configuring a Redundant Alarm and Event Server Currently, Alarm and Event Servers cannot be configured for redundancy.

Support for redundant Alarm and Event Servers will be added in the future.


Starting a Redundant FactoryTalk View SE System

When initializing/deploying a distributed system with redundancy, the boot order is important. Each software

component should have all services fully initialized before proceeding to the next step. For more information, see

AID 38087 - Recommended Startup Procedure for FactoryTalk Distributed Architectures.

Behavior at Startup

• When the computer hosting the primary HMI server is booted, the FactoryTalk Directory informs all the

computers in the application that the HMI or OPC data server is starting.

• When the server has finished starting, the FactoryTalk Directory informs all the computers in the

application that the server is active and all the clients should be using that server.

• If HMI alarming is configured to start in the component startup or in the startup macro, then alarming

will start putting all the tags on scan.

• For all tag requests all tag items will be added to both the primary and secondary data server OPC

groups.

• Just the primary data server will activate the tags (put tags on scan).

• The On active macro will be run on the primary HMI server computer as it is now active.

• Once all the alarmed tags are on scan, the alarm state will be synchronized to the secondary HMI server.

When the alarms are synchronized to the secondary HMI server, the tags will be put on scan on the

secondary HMI server to ensure a quick failover in case the primary HMI server fails.

• The On standby macro will be run on the secondary HMI server computer as it is standby.

Determining Active and Standby Server The following methods can be used to determine the active and standby servers in the redundant server pair:

1. FactoryTalk View Studio

2. FactoryTalk View Administration Console.

3. A display on the SE Client

4. The FactoryTalk Diagnostics viewer

To view HMI and Data Server status using FactoryTalk View Studio or the FactoryTalk View Administration

Console:

• Open FactoryTalk View Studio (or the FactoryTalk View Administration Console) from the Windows

Start\Programs menu.

• In the Product Type Selection dialog, select Site Edtion (Network) and click Continue.

• In New/Open SE Site Edtion (Network) Application dialog, select the Existing, select your application

and click Open.

• When your application has opened, right click on the HMI or Data server and select Server Status…

• The top section of the Server Status dialog box shows the Server status for both the primary and secondary

Servers.


The possible server states are:

• Loading

• Starting

• Ready to provide service

• Synchronizing with Standby

• Synchronized - ready to be Active

• Synchronizing with Active

• Synchronized – ready to be Standby

• Active

• Active (Can’t reach partner)

• Active

• Standby

• <Host> unreachable

• Failed

• Not Loaded

• Not configured

Manual Switchover The active Server can be changed manually (without shutting down a server or stopping services) by clicking on the

Switchover button. The server that is currently on standby will become the active server while the currently active

server will then become the standby server.


To view HMI and Data Server status using the SE Client:

• If you would like to display the server status for the FT Directory, HMI and Data Servers on the SE Client at

runtime, you can do so using the Display Client Object Model.

See AID 44624 - Determining any Server's Current Status and State in a Display Client

To view HMI and Data Server status using the FactoryTalk Diagnostics Viewer:

• From the Windows Start menu, select Programs, Rockwell Software, FactoryTalk Utilities, Diagnostics

Viewer to open the FactoryTalk Diagnostics Viewer

• If not already at the bottom, move the scroll bar for the Diagnostics List to the bottom of the list of system

events. Messages should be displayed that show whether the server is active or standby.

In the example below, the secondary HMI server ‘USCST7PLUSSEC’ in the application ‘Redundancy

Technote’ has become active at 11:04:01 AM:

HMI Server Fail-over and Switchback

Fail-over Process The following process occurs when an HMI Server fails:

• The secondary HMI server observes that the primary HMI server is no longer available so the secondary

HMI server determines that it will become active

• The On Active macro is run on the secondary HMI server.

• The clients observe that the primary HMI server is no longer available and will connect to the secondary

HMI server when it becomes the active HMI Server.


Continue Using Secondary Server The following process occurs when a primary HMI Server returns to service when the HMI server is configured to

"Continue using the secondary server even when the primary server becomes available again":

• The primary HMI server is available once all the services are loaded

• The secondary HMI server will remain active

• The primary HMI server will go into standby mode

• All the clients will remain connected to the secondary HMI server

• To manually switch back the HMI server to the primary, click the Switchover button in the Server Status

dialog box or stop the HMI server services on the secondary.

In the event of a partitioned network where some clients are connected to the primary HMI Server and the remaining

clients are connected to the secondary HMI Server, see P 14-19 of the SE User Guide for details on determining

which HMI server will become active when the network is restored. In the case where an equal number of client are

attached to each HMI Server, the primary HMI Server will become active, over-riding the “Continue Using

Secondary Server” option.

In the case where there is a single SE client connected to a redundant pair of HMI Servers, the primary HMI server

(also hosting the FactoryTalk Directory) will become the active HMI server when re-connected to the network, over-

riding the “Continue Using Secondary Server” option. For more details on this scenario, see the FactoryTalk

Administration Console (FTAdminEN.chm) Help topic “Unexpected switch over to primary server”. This

subtopic can be found under the main “Redundant Server” Help topic.

Switchback from Secondary to Primary HMI Server The following process occurs when an HMI Server switches back from the secondary to the primary:

• The primary HMI server is available once all the services are loaded

• The primary HMI server will get the current alarm state from the active secondary HMI server

• Once the alarm state is synchronized, the primary HMI server will put all the alarmed tags on scan

• The On active macro will be run on the primary HMI server.

• The primary HMI Server becomes Active.

• All the clients will switch over to the active primary HMI server

Any alarm transactions that were buffered during the switchback will be processed.

All the clients will show the alarm information from the primary HMI server

• If the clients show a blank alarm summary this is because the clients have switched over to the

primary HMI server but the alarm state synchronization had not finished. No alarm summary

information is shown rather than showing incomplete alarm summary information. Alarm

transactions that occur during the switchback are buffered to be processed with the newly

synchronized alarm state

HMI Server Switchback Delay (pre-CPR9) The HMI Server Switchback delay is no longer required for HMI Servers in CPR9 as clients cannot connect to an

HMI Server before it becomes active. This parameter is only applicable to pre-CPR9 HMI Servers.


The default HMI server switchback delay is 2 minutes. This has been tested with medium to large

scale applications. This delay should be increased when the alarm summary on clients is empty for a long period of

time after a reboot of the primary HMI server.

• In FactoryTalk View Studio, select System in the Application Explorer

• Navigate to Polices, System Policies, Health Monitoring Policy

• Change the setting Maximum delay before server is active (in minutes)

Data Server Fail-over and Switchback

Fail-over Process The following process occurs when an Active Data Server fails. In this example, the primary data server is the active

server:

• The secondary data server observes that the primary data server is no longer available so the secondary

data server determines that it will become active

• The secondary data server activates all items in its OPC group (puts its tags on scan)

• The secondary data server becomes active and the clients switch to the secondary data server.


Continue Using Secondary Server The following process occurs when a primary Data Server returns to service when the data server is configured to

"Continue using the secondary server even when the primary server becomes available again":

• The primary data server is available once all the services are loaded

• The secondary data server will remain active

• The primary data server will go into standby mode

• All the clients will remain connected to the secondary data server

• To manually switch back the data server to the primary, click the Switchover button in the Server Status

dialog box or stop the data server on the secondary.

Switchback from Secondary to Primary Data Server The following process occurs when a primary Data Server returns to service when the data server is configured to

"Switchback to primary server when it becomes available again":

• The primary data server is available once all the services are loaded.

When the primary data server is available, it will become the active data server.

All the items will have to be added to the OPC groups from all the client displays and HMI server

components (alarming, data logging...)

Activate all the newly added items.

• This could take some time.

• The secondary data server will go into standby mode.

All the clients will connect to the primary data server.

Note: a reboot is not required for the:

• Primary HMI Server after the secondary HMI server becomes active

• Secondary HMI Server after the primary HMI server becomes active

Testing Server Redundancy FactoryTalk View Server Redundancy protects against the failure of the HMI Server, Data Server or the computer

that the HMI /Data server is running on. To protect against network failures use redundant media and a NIC card that

supports redundant media such as the Intel Pro/100 S Dual Port Server Adapter,

http://www.intel.com/support/network/adapter/pro100/pro100sdp/index.htm.

To simulate a HMI Server failure, do one of the following:

• Stop the HMI server using the HMI Server Service Manager

• Shutdown the HMI server computer

• Disconnect the network cable from the HMI Server computer

To simulate a Data Server failure, do one of the following:

• Disable the Data Server service (to prevent local/remote clients re-starting the service) and then Stop the

service

• Shutdown the Data server computer

• Disconnect the network cable from the Data Server computer


References • FactoryTalk View Site Edition Installation Guide

http://literature.rockwellautomation.com/idc/groups/literature/documents/in/viewse-in003_-en-p.pdf

• FactoryTalk View Site Edition User's Guide Volume 1

http://literature.rockwellautomation.com/idc/groups/literature/documents/um/viewse-um004_-en-e.pdf

• FactoryTalk View Site Edition User's Guide Volume 2

http://literature.rockwellautomation.com/idc/groups/literature/documents/um/viewse-um005_-en-e.pdf

View Site Edition Server Redundancy Guidelines SE V5.0(CPR7)Server Redundancy... · FTView SE 5.0...

Documents

Transcript of View Site Edition Server Redundancy Guidelines SE V5.0(CPR7)Server Redundancy... · FTView SE 5.0...