FactoryTalk View Site Edition V5.0 (CPR9) Server Redundancy Guidelines

Transcription

1 FactoryTalk View Site Edition V5.0 (CPR9) Server Redundancy Guidelines

2 This page left intentionally blank. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 2 of 27

3 Table of Contents Introduction...4 Redundancy enhancements in CPR9...5 Configuration & Operation & Tips...9 Terminology...9 Redundant System Topologies...10 Revision Maintenance of FactoryTalk View SE...11 Setting up a Redundant FactoryTalk View SE System...11 Starting a Redundant FactoryTalk View SE System...21 References...27 FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 3 of 27

4 Introduction This document serves as a supplement to Chapter 14: Setting up FactoryTalk system availability in the FactoryTalk View Site Edition User's Guide Volume 1 (Aug 2007). Its purpose is to: introduce the new redundancy features of CPR9 (Aug 2007) provide supplemental Configuration, Operation and Troubleshooting tips for redundant SE 5.0 systems The User s Guide is considered prerequisite reading for this document. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 4 of 27

5 Redundancy enhancements in CPR9 The following enhancements can be found in CPR9: Server Status dialog shows the current server status and allows manual switchover of servers. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 5 of 27

6 Favor current switchback option for HMI Servers allows clients to continue using the secondary HMI Server when the primary HMI Server becomes available. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 6 of 27

7 New Display Client Object Model GetServerState method, ServerStateChanged event and gfxserverstateconstants. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 7 of 27

8 Health Monitoring parameters application wide settings to tune the application accommodate network issues. Changes to these settings are NOT recommended unless directed by Technical Support personnel. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 8 of 27

9 Configuration & Operation & Tips Terminology The following terms are used in this document. When the term is used, its meaning is as follows: Active server The server in a redundant server pair that is actively providing service to client computers. New clients can connect to the Active server. Alarm state synchronization HMI servers in a redundant server pair keep alarm information synchronized between the two server computers. This occurs via alarm state synchronization. Controlled switchover Fail-over FavorCurrent User-initiated switch of Active server from currently active to the Standby server in the redundant pair. The Active server fails and the Standby server becomes the Active server. Clients connected to the failed server will automatically reconnect to the new Active server. The server setting Continue using the secondary server even when the primary server becomes available again that specifies that an Active secondary server will remain active after the primary server in the redundant pair is brought online and that the primary server will become the Standby server. This is the default setting for all new servers. FavorPrimary HMI switchback delay Host computer Logical server Network disconnect Network glitch On active macro The server setting Switch over to the primary server when it becomes available that specifies the primary server will become active whenever it is ready to provide service. If the secondary server is running as the Active server when the primary is brought online, the secondary will become standby and all connected clients will automatically reconnect to the Active primary server. This is the default setting for all HMI servers created in RSView SE 4.00 or earlier. When a (pre-cpr9) primary HMI server comes back online after a failure or shutdown, there is a configurable delay to allow alarm state synchronization to occur before clients can connect to the (pre-cpr9) primary server. The default is two minutes and can be configured through a policy setting. The physical computer that runs the server. A server instance that runs a server configuration. A loss of communication between the host computer and the network of five seconds or greater. A network glitch is a temporary server disconnect from the network or the inability of the server to talk to the other nodes in the distributed application due to noise, network switch reset/reconfiguration or fluctuations in network traffic. The On active macro is run when an HMI server transitions to active mode, either on boot or from standby mode. The commands in the On active macro should include components that should only be run when an HMI server is active. Examples of services that should be run when a server becomes active include: data logging, derived tags and event detector. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 9 of 27

10 On standby macro Partner server The On standby macro is run when an HMI server transitions to standby mode, either on boot or from active mode. The commands in the On standby macro should include components that should only be run when an HMI server is standby or shutting down services that are active server components. Examples of services that should be shut down when a server becomes standby include: data logging, derived tags and event detector. The server associated with a given server in a redundant server pair. Primary server Redundant server pair Secondary server ServerPing Standby server Switchback Switchover Reboot The server in the redundant server pair that will normally be the Active server. A pair of identically configured logical servers running on different host computers that act together to provide clients with fault-tolerant service. If one server in the pair fails, the other server will automatically take its place to ensure that service to clients is not lost. The server in the redundant server pair that will normally be the Standby server. Determines the status of all the software and hardware in a distributed SE application The server in a redundant server pair that is waiting to provide service to client computers in the event the Active server fails. New clients will not connect to the Standby server. The activity of automatically switching from an Active Secondary to the Primary server when the primary comes into service. This occurs for servers that are configured to switch back to the primary server when it becomes available The activity of switching the current Active server to the Standby server. The Standby server becomes the Active server and the former Active server becomes the Standby. This can occur automatically when the server is configured as FavorPrimary or through the controlled switchover mechanism when the server is configured as FavorCurrent. Whenever this document refers to rebooting a server computer, it is recommended that a Windows shutdown is performed. Once the machine is shut down, then the computer should be powered back on. This ensures that Windows does not hold on to incorrect information in memory. Redundant System Topologies Refer to Planning the layout of a redundant system in Chapter 14 in the FactoryTalk View Site Edition User's Guide for guidelines and limits of a redundant architecture. Be sure to consider CPU loading factors and server activity when creating your redundant system architecture. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 10 of 27

11 Revision Maintenance of FactoryTalk View SE In a distributed FactoryTalk View SE system, it is critical that all computers have the same version of the software (including post-release patches). Prior to configuring redundancy, you should update all FactoryTalk View SE computers up with the latest patches and verify that all computers are at the same level. See AID FactoryTalk View Site Edition (CPR9) Patch TOC. Setting up a Redundant FactoryTalk View SE System The following sections provide additional detail to the FactoryTalk View Site Edition User's Guide section entitled Setting up FactoryTalk system availability on page Prior to completing the steps below, you must have already created your FactoryTalk Application and HMI project(s) and Data Server(s). For details, refer to the FactoryTalk View Site Edition User's Guide, Chapter 6: Working with network applications. Configuring a Redundant HMI Server The steps that should be performed to configure a redundant HMI server are as follows: 1. Copy the HMI project files from the primary HMI Server to the identical location on the designated secondary HMI Server. The utility in AID RSView SE - Backup and Restore Utility for HMI Server can be used to copy HMI project files. Note: The Replicate button can only be used to synchronize HMI project files after redundancy has been setup. 2. Launch FactoryTalk View Studio. Note: FactoryTalk View Studio may be launched on the primary HMI Server, secondary HMI Server, or virtually any remote computer that uses the same FactoryTalk Directory as the HMI Servers. 3. In the Product Type Selection dialog, select Site Edtion (Network) and click Continue. You may be prompted to Log On to FactoryTalk. Note: If you are not prompted to log on, then FactoryTalk s Single Sign-on feature is enabled and configured. For more information on FactoryTalk Security, please refer to the FactoryTalk View SE User's Guide, Chapter 5: Setting up security. 4. Log On to FactoryTalk as an administrator (if required). 5. In New/Open Site Edition (Network) Application dialog: select the Existing tab select your Application select your Language click Open. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 11 of 27

12 6. When your application has opened, right click on the HMI server you want to make redundant and select Properties The HMI Server Properties page for the selected HMI server will open. 7. On the HMI Server Properties General tab, change the Startup type to Load and run startup components when operating system initializes (Redundancy cannot be configured if this option is set to On demand): 8. Click Apply to save the Startup type setting. 9. Select the Redundancy tab and click the Provide redundancy using a secondary server checkbox to turn redundancy on for the selected HMI server. In the Computer hosting the secondary server field, enter (or browse for) the name of the computer that will host the secondary server: FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 12 of 27

13 Note: The default Switch back option for newly created HMI Servers is Continue using the secondary server.... This means that when your primary server fails or is shutdown, the secondary server will become the active server. When your primary server comes back online, the secondary HMI Server will continue to function as your HMI Server and clients will remain connected to the secondary. When Continue using the secondary server is selected, you must either manually switch the active server (from the Server Status dialog) or shutdown the secondary server computer to switch from the secondary back to the primary as the active HMI Server. Selecting the Switchback to primary server option means that when the primary server comes back online, the primary will automatically become active and the switchback from the secondary server will occur without user intervention. This is the default setting for HMI Servers created with RSView SE 4.0 or earlier. 10. Click Apply to verify the HMI Server configuration on the computer hosting the secondary HMI Server. 11. Click on OK and the secondary HMI Server will be loaded, alarming will be synchronized and will then become the standby server. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 13 of 27

14 12. Right click on the redundant HMI server and select Properties The HMI Server Properties page for the selected HMI server will open. Select the Components tab and configure your On startup components. Note: In a non-redundant system, enabled On startup components would typically include Alarming, Data logging, Derived tags and Events. However, in a redundant system, Alarming is the typically the only component that runs on both the Active and Standby servers. The remaining components are typically running only on the Active server and are therefore started in the On active macro and stopped in the On standby macro. Only components that should be running on both the Active and Standby servers should be configured in the On startup components. 13. Configure an On active macro for commands that should be run when the server becomes Active (this includes startup). Note: If you have checked the Alarming checkbox, you do not need to place the AlarmOn command in the On active macro. 14. Configure an On standby macro for commands that should be run when the server becomes Standby. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 14 of 27

15 15. Click Apply to save the changes to your HMI Server Components configuration. 16. Return to the Redundancy tab and click Replicate Primary to Secondary Read the information provided and click Yes to continue. This will transfer the Components configuration you just completed to the secondary HMI computer and verify that the setup is correct and that the replication feature is working properly. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 15 of 27

16 Configuring a Redundant RSLinx Enterprise Data Server The steps that should be performed to configure a redundant RSLinx Enterprise Server are as follows: 1. Launch FactoryTalk View Studio. Note: FactoryTalk View Studio may be launched on the primary Data Server, secondary Data Server, or virtually any remote computer that uses the same FactoryTalk Directory as the RSLinx Enterprise Data Servers. 17. In the Product Type Selection dialog, select Site Edtion (Network) and click Continue. You may be prompted to Log On to FactoryTalk. Note: If you are not prompted to log on, then FactoryTalk s Single Sign-on feature is enabled and configured. For more information on FactoryTalk Security, please refer to the FactoryTalk View Site Edition User's Guide, Chapter 5: Setting up security. 2. Log On to FactoryTalk as an administrator (if required). 3. When your application has opened, right click on the RSLinx Enterprise data server you want to make a redundant server and select Properties and the RSLinx Enterprise Server Properties page for the selected RSLinx Enterprise server will open. 4. Select the Redundancy tab to configure a secondary RSLinx Enterprise data server. 5. Click the Provide redundancy using a secondary server checkbox to turn redundancy on for the selected RSLinx Enterprise server. In the Computer hosting the secondary server field, enter the name of the computer that will host the secondary server: FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 16 of 27

17 Note: The default Switch back option is Continue using the secondary server... This means that when your primary server fails or is shutdown, the secondary server will become the active server. When your primary server comes back online, the secondary RSLinx Enterprise Data Server will continue to function as your active data server and clients will remain connected to the secondary. When Continue using the secondary server is selected, you must either manually switch the active server (from the Server Status dialog) or you must shutdown the secondary server computer to switch from the secondary back to the primary as the active RSLinx Enterprise data server. Selecting the Switchback to primary server option means that when the primary server comes back online, the primary will automatically become active and the switchback from the secondary server will occur without user intervention. 6. Click OK to save the changes you have made to the RSLinx Enterprise Server properties and close the properties dialog. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 17 of 27

18 7. Double-click on the Communication Setup icon in the Application Explorer to launch the Communication Setup dialog shown below: 8. In the Primary tab, you will have configured the RSLinx Enterprise device shortcuts for your primary server. Click the Secondary tab and configure the same device shortcut on your secondary computer. Note: RSLinx Enterprise software must be installed on the secondary Data Server. 9. Click Apply to save the new shortcut then OK to save the Communication Setup information. Configuring a Redundant OPC Data Server The steps that should be performed to configure a redundant OPC Data Server are as follows: 1. Copy the OPC Data Server project files to the proper location on the designated secondary Data Server. For details, see Moving data server files on page of the FactoryTalk View Site Edition User's Guide. 2. Launch FactoryTalk View Studio. Note: FactoryTalk View Studio may be launched on the primary OPC Data Server, secondary OPC Data Server, or virtually any remote computer that uses the same FactoryTalk Directory as the OPC Data Server. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 18 of 27

19 3. In the Product Type Selection dialog, select Site Edtion (Network) and click Continue. You may be prompted to Log On to FactoryTalk. Note: If you are not prompted to log on, then FactoryTalk s Single Sign-on feature is enabled and configured. For more information on FactoryTalk Security, please refer to the FactoryTalk View Site Edition User's Guide, Chapter 5: Setting up security. 4. Log On to FactoryTalk as an administrator (if required). 5. When your application has opened, right click on the OPC Data Server you want to make a redundant server and select Properties and the OPC Server Properties page for the selected OPC server will open. 6. Select the Redundancy tab to configure a secondary OPC data server. 7. Click the Provide redundancy using a secondary server checkbox to turn redundancy on for the selected OPC server. In the Computer hosting the secondary server field, enter the name of the computer that will host the secondary server: Note: The default Switch back option is Continue using the secondary server This means that when your primary server fails or is shutdown, the secondary server will become the active server. When your FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 19 of 27

20 primary server comes back online, the secondary OPC data server will continue to function as your active data server and clients will remain connect to the secondary. When Continue using the secondary server is selected you must either manually switch the active server (from the Server Status dialog) or you must shutdown the secondary server computer to switch from the secondary back to the primary as the active OPC data server. Selecting the Switchback to the primary server when it becomes available again option means that when the primary server comes back online, the primary will automatically become active and the switchback from the secondary server will occur without user intervention. 8. Click OK to save the changes you have made to the OPC Data Server properties and close the properties dialog. Note: Any subsequent changes to the configuration of RSLinx Classic as the primary Data Server must be duplicated on the secondary Data Server. This can be accomplished by using the RSLinx Classic GUI locally on both servers, or by backing up the changes on the primary and restoring them on the secondary. Configuring a Redundant Alarm and Event Server Currently, Alarm and Event Servers cannot be configured for redundancy. Support for redundant Alarm and Event Servers will be added in the future. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 20 of 27

21 Starting a Redundant FactoryTalk View SE System When initializing/deploying a distributed system with redundancy, the boot order is important. Each software component should have all services fully initialized before proceeding to the next step. For more information, see AID Recommended Startup Procedure for FactoryTalk Distributed Architectures. Behavior at Startup When the computer hosting the primary HMI server is booted, the FactoryTalk Directory informs all the computers in the application that the HMI or OPC data server is starting. When the server has finished starting, the FactoryTalk Directory informs all the computers in the application that the server is active and all the clients should be using that server. If HMI alarming is configured to start in the component startup or in the startup macro, then alarming will start putting all the tags on scan. For all tag requests all tag items will be added to both the primary and secondary data server OPC groups. Just the primary data server will activate the tags (put tags on scan). The On active macro will be run on the primary HMI server computer as it is now active. Once all the alarmed tags are on scan, the alarm state will be synchronized to the secondary HMI server. When the alarms are synchronized to the secondary HMI server, the tags will be put on scan on the secondary HMI server to ensure a quick failover in case the primary HMI server fails. The On standby macro will be run on the secondary HMI server computer as it is standby. Determining Active and Standby Server The following methods can be used to determine the active and standby servers in the redundant server pair: 1. FactoryTalk View Studio 2. FactoryTalk View Administration Console. 3. A display on the SE Client 4. The FactoryTalk Diagnostics viewer To view HMI and Data Server status using FactoryTalk View Studio or the FactoryTalk View Administration Console: Open FactoryTalk View Studio (or the FactoryTalk View Administration Console) from the Windows Start\Programs menu. In the Product Type Selection dialog, select Site Edtion (Network) and click Continue. In New/Open SE Site Edtion (Network) Application dialog, select the Existing, select your application and click Open. When your application has opened, right click on the HMI or Data server and select Server Status The top section of the Server Status dialog box shows the Server status for both the primary and secondary Servers. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 21 of 27

22 The possible server states are: Loading Starting Ready to provide service Synchronizing with Standby Synchronized - ready to be Active Synchronizing with Active Synchronized ready to be Standby Active Active (Can t reach partner) Active Standby <Host> unreachable Failed Not Loaded Not configured Manual Switchover The active Server can be changed manually (without shutting down a server or stopping services) by clicking on the Switchover button. The server that is currently on standby will become the active server while the currently active server will then become the standby server. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 22 of 27

23 To view HMI and Data Server status using the SE Client: If you would like to display the server status for the FT Directory, HMI and Data Servers on the SE Client at runtime, you can do so using the Display Client Object Model. See AID Determining any Server's Current Status and State in a Display Client To view HMI and Data Server status using the FactoryTalk Diagnostics Viewer: From the Windows Start menu, select Programs, Rockwell Software, FactoryTalk Utilities, Diagnostics Viewer to open the FactoryTalk Diagnostics Viewer If not already at the bottom, move the scroll bar for the Diagnostics List to the bottom of the list of system events. Messages should be displayed that show whether the server is active or standby. In the example below, the secondary HMI server USCST7PLUSSEC in the application Redundancy Technote has become active at 11:04:01 AM: HMI Server Fail-over and Switchback Fail-over Process The following process occurs when an HMI Server fails: The secondary HMI server observes that the primary HMI server is no longer available so the secondary HMI server determines that it will become active The On Active macro is run on the secondary HMI server. The clients observe that the primary HMI server is no longer available and will connect to the secondary HMI server when it becomes the active HMI Server. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 23 of 27

24 Continue Using Secondary Server The following process occurs when a primary HMI Server returns to service when the HMI server is configured to "Continue using the secondary server even when the primary server becomes available again": The primary HMI server is available once all the services are loaded The secondary HMI server will remain active The primary HMI server will go into standby mode All the clients will remain connected to the secondary HMI server To manually switch back the HMI server to the primary, click the Switchover button in the Server Status dialog box or stop the HMI server services on the secondary. In the event of a partitioned network where some clients are connected to the primary HMI Server and the remaining clients are connected to the secondary HMI Server, see P of the SE User Guide for details on determining which HMI server will become active when the network is restored. In the case where an equal number of client are attached to each HMI Server, the primary HMI Server will become active, over-riding the Continue Using Secondary Server option. In the case where there is a single SE client connected to a redundant pair of HMI Servers, the primary HMI server (also hosting the FactoryTalk Directory) will become the active HMI server when re-connected to the network, overriding the Continue Using Secondary Server option. For more details on this scenario, see the FactoryTalk Administration Console (FTAdminEN.chm) Help topic Unexpected switch over to primary server. This subtopic can be found under the main Redundant Server Help topic. Switchback from Secondary to Primary HMI Server The following process occurs when an HMI Server switches back from the secondary to the primary: The primary HMI server is available once all the services are loaded The primary HMI server will get the current alarm state from the active secondary HMI server Once the alarm state is synchronized, the primary HMI server will put all the alarmed tags on scan The On active macro will be run on the primary HMI server. The primary HMI Server becomes Active. All the clients will switch over to the active primary HMI server Any alarm transactions that were buffered during the switchback will be processed. All the clients will show the alarm information from the primary HMI server If the clients show a blank alarm summary this is because the clients have switched over to the primary HMI server but the alarm state synchronization had not finished. No alarm summary information is shown rather than showing incomplete alarm summary information. Alarm transactions that occur during the switchback are buffered to be processed with the newly synchronized alarm state HMI Server Switchback Delay (pre-cpr9) The HMI Server Switchback delay is no longer required for HMI Servers in CPR9 as clients cannot connect to an HMI Server before it becomes active. This parameter is only applicable to pre-cpr9 HMI Servers. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 24 of 27

25 The default HMI server switchback delay is 2 minutes. This has been tested with medium to large scale applications. This delay should be increased when the alarm summary on clients is empty for a long period of time after a reboot of the primary HMI server. In FactoryTalk View Studio, select System in the Application Explorer Navigate to Polices, System Policies, Health Monitoring Policy Change the setting Maximum delay before server is active (in minutes) Data Server Fail-over and Switchback Fail-over Process The following process occurs when an Active Data Server fails. In this example, the primary data server is the active server: The secondary data server observes that the primary data server is no longer available so the secondary data server determines that it will become active The secondary data server activates all items in its OPC group (puts its tags on scan) The secondary data server becomes active and the clients switch to the secondary data server. FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 25 of 27

26 Continue Using Secondary Server The following process occurs when a primary Data Server returns to service when the data server is configured to "Continue using the secondary server even when the primary server becomes available again": The primary data server is available once all the services are loaded The secondary data server will remain active The primary data server will go into standby mode All the clients will remain connected to the secondary data server To manually switch back the data server to the primary, click the Switchover button in the Server Status dialog box or stop the data server on the secondary. Switchback from Secondary to Primary Data Server The following process occurs when a primary Data Server returns to service when the data server is configured to "Switchback to primary server when it becomes available again": The primary data server is available once all the services are loaded. When the primary data server is available, it will become the active data server. All the items will have to be added to the OPC groups from all the client displays and HMI server components (alarming, data logging...) Activate all the newly added items. This could take some time. The secondary data server will go into standby mode. All the clients will connect to the primary data server. Note: a reboot is not required for the: Primary HMI Server after the secondary HMI server becomes active Secondary HMI Server after the primary HMI server becomes active Testing Server Redundancy FactoryTalk View Server Redundancy protects against the failure of the HMI Server, Data Server or the computer that the HMI /Data server is running on. To protect against network failures use redundant media and a NIC card that supports redundant media such as the Intel Pro/100 S Dual Port Server Adapter, To simulate a HMI Server failure, do one of the following: Stop the HMI server using the HMI Server Service Manager Shutdown the HMI server computer Disconnect the network cable from the HMI Server computer To simulate a Data Server failure, do one of the following: Disable the Data Server service (to prevent local/remote clients re-starting the service) and then Stop the service Shutdown the Data server computer Disconnect the network cable from the Data Server computer FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 26 of 27

27 References FactoryTalk View Site Edition Installation Guide FactoryTalk View Site Edition User's Guide Volume 1 FactoryTalk View Site Edition User's Guide Volume 2 FTView SE 5.0 (CPR9) Server Redundancy Guidelines.doc 8/19/2008 Page 27 of 27