The Fieldbus Years

With 2009 marking the tenth anniversary of the IEC 61158 fieldbus standard, Jonas Berge examines the rise of digital for automation and explains why more than one bus protocol became necessary.

Digital technology is pervasive. Music has gone there with CDs and MP3. Cameras, mobile phones, email, highdefinition television, photocopiers, musical instruments, car engine controls, and many more are digital. In the same vein, digital bus technology, or “fieldbus” provides improvements for automation and control.

Smart transmitters appeared in the mid-1980s. Because manufacturers used proprietary protocols, distributed control systems (DCS) and handheld communicators were compatible only with devices from the same manufacturer, severely limiting the choice of devices for installation in process industry plants. Similarly, in factories, a PLC only worked with drives from its manufacturer.

Hence, the need for interoperability between devices from different manufacturers was the main driving force for a standard fieldbus. Another driver was the desire by system designers for a multi-drop bus and digital closed-loop control.

Although the consequent effort to create the fieldbus standard – which was officially completed 10 years ago with the release of IEC 61158 – resulted in not one but many protocols commonly referred to as “fieldbus”, importantly, it did produce a quantum leap in technology and major international corporations began to implement fieldbus networks.

Enhancements to electronic device description language (EDDL) have made it easy to use fieldbus; the ever more rigorous testing of devices and systems has improved interoperability between the digital bus products from different manufacturers; simpler solutions for hazardous areas have become available; troubleshooting tools have evolved, and engineering guidelines have been established.

After years of refinements, products and systems implementing fieldbus technologies have matured, and many complementing accessories and supporting services have become available

Digital delivers

Fieldbus technology enables connection of multiple devices in parallel on the same pair of wires with each device recognized by a unique address. This reduces the cost of wire and cable trays as well as labor to install trays, lay cable, cut, strip, crimp, label, and connect. Costs are even lower than for remote-I/O.

Variable speed drives and electric actuators are representative of highly attractive and successful bus devices, because they each save many wires. Indeed, devices traditionally requiring multiple wires were the first significant users of bus technology because it meant fewer digital input and output cards and cabinets, and simplified integration – all of which reduce project costs. All fieldbus valves provide continuous actual position feedback and bumpless transfer without additional wiring and input cards, resulting in better process operation.

Fieldbus uses pure digital communication, largely eliminating digital-to-analog and analog-to-digital conversion, and delivering higher resolution and accuracy as a result. Improvements for transmitters, valves, loops, and process units employing fieldbus yield better total plant performance. Moreover, digital values are not distorted and communication errors can easily be detected.

Fieldbus devices transmit measurements as real numbers in engineering units that are received unaltered on the other end. Since the reported digital process variable (PV) will not be skewed, readings, control, and alarms in the system will be correct. Digital transmitters measure over the full sensor limits and do not saturate at a set range, providing valuable information during abnormal conditions. Moreover, the traditional five-point loop test can be replaced by a simple plausibility check.

When transmitters, controllers, and valve positioners are all digital, passing digital signals between them makes sense. Deterministic communication make possible a real-time closed loop that is digital from sensor to valve. Fieldbus also communicates measurement validity, indicating if a value is good for control, uncertain, or bad due to sensor failure or other problem. Thus, a digital system can distinguish process problems from device problems so that automatic control action is not taken on invalid information. This results in better control and higher availability.

Bus devices can also communicate fast enough to accept firmware downloads online without being removed, making it easy to incorporate new features. With high-speed communication, displays load faster and alerts arrive quicker.

Fieldbus multi-point devices such as high-density temperature transmitters with eight sensor inputs drastically reduce the number of transmitters required, the amount of wiring between the field and control room, and associated labor. For this reason, fieldbus represents a very attractive and successful solution for temperature profiling and similar applications. The multi-solenoid valve bank is another cost-reducing solution by providing several channels in one device.

Advanced diagnostics is an often cited reason for users to go for fieldbus. For instance, two-wire bus devices are permitted to draw sufficient current to drive powerful electronics and software, enabling sophisticated diagnostics such as thermocouple degradation prediction (see Control Engineering Asia, Jan-Feb 2009) enabling effective maintenance.

Bus technologies now digitally integrate discrete devices such as on/off valves and electric actuators that traditionally relied on on/ off signals and so did not provide feedback communication. Thanks to fieldbus, predictive diagnostics can now come from discrete devices that were not digitally integrated in the past.

Different needs, different buses

On the surface Foundation fieldbus, DeviceNet, Profibus-DP, and Modbus may appear to provide the same benefits, but they are different. Buses for factory automation and process control were designed for different requirements. A single technology could not be agreed upon because the requirements were too diverse, and there was no room for compromise.

So in 1999, eight technologies were included in the same standard – IEC 61158 – which has since grown to include others based on Ethernet. The IEC 61158 standard “slices” the protocols into functional “layers”. A profile standard IEC 61784-1 defines how the functional layers are combined to form the actual protocols, grouped into each Communication Profile Family (CPF).

The main standard debate was around the data link layer (in the ISO seven-layer model), the function that controls which device transmits data and when. The French standard FIP and German standard Profibus represented two opposing philosophies. Since both had strong points, the IEC proposal combined them into one.

The two solutions can be explained with a transportation analogy: FIP operates like a train, transporting data according to a preestablished schedule without traffic jams. Profibus operates like a car, free to go any time provided there is no other traffic. Train-like scheduling is important for PID loops and motion control, but is not necessary for factory automation. Foundation fieldbus is based on the original IEC proposal drawing on both FIP and Profibus to get scheduling but to also allow ad-hoc monitoring and diagnostics.

The PLC world of factory automation and the DCS world of process control have different requirements. Therefore bus technologies were designed to the different criteria required by the two distinct forms of manufacturing (see Table 2).

While there were originally eight, now some 20 types of buses are part of the IEC 61158 fieldbus standard. Different technologies compete within each application area: Profibus-DP, DeviceNet, and CC-link technologies for the factory automation market; HART, Foundation fieldbus, and the PA flavor of Profibus for the process control market; and Profinet, Sercos, and others compete for motion control applications.

Need for Speed

Factories have fast moving conveyor belts and machines for packaging, printing, and assembly, requiring response time of just a few milliseconds. Sensors and actuators for these applications are not connected directly to a fieldbus, but use conventional wiring to an I/O-subsystem that in turn connects to the bus. When a state changes, it must quickly be communicated to the PLC. Therefore, factory automation requires high speed communication, and realtime data must not be held up while the bus is idle.

DeviceNet can run as fast as 500 Kb/s and Profibus-DP 12 Mb/s for short distances achieving short bus cycles. Profibus is free-running, meaning that when configuration and other non-realtime data is communicated, the cyclic real-time I/O updates slow down somewhat. But when there is no acyclic communication, the bus is not left idle; updates are done as fast as possible enabling the machines to run faster. The scan is not precisely periodic, but that does not matter in factory automation.

Need for Synch

For process control, a response period of 250 ms to one second is sufficient for closed loops, but the sampling interval must be constant to achieve tight PID control. This is because the integral and derivative terms of the PID algorithm contain a “dt” which is a constant. Therefore the bus cycle must be precisely periodic, that is, the exact same interval every scan. Similarly, input and output sampling in the transmitter and valve must be synchronized with control and communication.

Foundation fieldbus is time synchronized with all devices having an internal real-time clock and operating in synch with the system. This enables a precisely periodic bus cycle and sampling period, called macrocycle. Scheduling automatically created by the system ensures that function blocks are executed and real-time data communicated in the right order at exactly the right time, synchronized from transmitter to valve for optimum PID control.

Periodic real-time communication takes place in dedicated time-slots that are separate from the time-slots for non-real-time communication for configuration and monitoring so as to not interfere with real-time data. Foundation fieldbus devices report diagnostics like alarms, up to the system and included in the system log. For efficiency, reporting is by exception – that is, only when there is a change of state. Device field diagnostics are prioritized so that the system can deliver it to the right person, without a flood of alarms.

Need for organization

With hundreds or thousands of field instruments in a process plant coming in physical contact with the process, typically outdoors, exposed to freezing cold, sweltering heat, sea spray, corrosion, vibration, and shock, these devices will eventually degrade and need to be replaced. Keeping track of a device address and setting that same address correctly in a replacement device would be very difficult for technicians. But a Foundation fieldbus system automatically assigns addresses to all Foundation devices, avoiding the human errors associated with manually managed protocols and saving time.

Need for calibration

In factory automation the discrete inputs predominantly come through I/O-subsystems and the outputs may be solenoid valve banks or drives. These devices need no calibration. Thus ad-hoc connection of temporary master devices like a laptop or handheld field communicator is not required. In process control systems, however, the devices are predominantly transmitters, analyzers, and valve positioners which require calibration from time to time and in some cases need to be set up in the field. Foundation fieldbus technology supports multiple masters, enabling documenting calibrators, field communicators, and laptops to be connected impromptu to a running bus for calibration, setup, diagnostics, and monitoring purposes.

Bus commonalities

Although variable speed drives, motor control centers (MCCs), and motor starters are also used in process industries, manufacturers have not made them available with the Foundation fieldbus protocol, but they are generally available with other protocols.

A process plant may therefore require the digital plant architecture to incorporate two or more communication protocols to network all the devices: Foundation fieldbus to meet the needs of PID loops; Profibus for motor control; HART for the devices on the safety instrumented system (see Control Engineering Asia, Jun-Jul 2009); and WirelessHART.

These four protocols achieve tight integration and interoperability the same way - using EDDL. A mix of devices based on these protocols can be managed from the same single software, to leverage the power of field intelligence for improved plant performance. Intelligent devices contain a large amount of information, such as diagnostics of themselves as well as attached sensors and valves, plus parameters for set up of the device. Device manufacturers use IEC 61804-3 EDDL (www.eddl.org) to design device pages and the hierarchical menu system displayed in the system so the device is easy to use (see Control Engineering Asia, September 2007) .

Device information is presented as simple text or values, as well as multi-pen trend charts, multi-pen waveform graphs, dial gauges, bar-graphs, bar-charts, tables, and histograms. The user is guided step-by-step through complex procedures using EDDL wizards. Other user guidance from the device manufacturer includes illustrative images and help text, saving time interpreting and acting on diagnostics.That is, EDDL makes bus technologies easy to use, much like HTML (hypertext markup language) in web browser technology makes the internet easy to use.

What about Ethernet?

One commercial off-the Shelf (COTS) technology that has made its way into automation is Ethernet. Ethernet networking has the advantage that it is easy to use, it’s fast, and together with TCP/IP, it supports many different protocols at the same time. In fact, most bus technologies by now have a corresponding protocol for Ethernet, and some are complementing each other and others are competing among themselves just like bus technologies.

It was previously predicted the IEC 61158 standard would soon be eclipsed by Ethernet. However, it did not happen quite that way. Ethernet has indeed become a phenomenal success in automation, but at the higher control network level, not at the fieldbus level. DCS and PLC controllers are frequently networked to servers and workstations using Ethernet, but Ethernet is not used to connect field devices like transmitters and valves.

One reason is that its very high speed restricts the distance to only 100 m for copper wire. Fiber optic Ethernet reaches farther but is not as popular. Ethernet also needs LAN switches and dedicated cable to each device. This works well for controllers but becomes very costly for a large number of transmitters and valves. Fieldbus is thus a better solution for field instruments.

However, because one size does not fit all, fieldbus and Ethernet can complement each – much like the same way a computer has ports for Ethernet for connection to the higher level LAN and the Internet, plus USB to connect to underlying keyboard, mouse, digital camera, mobile phone, PDA, etc.

The same is even true for wireless in automation. High-speed wireless Ethernet IEEE 802.11 (Wi-Fi) is used for tablet PCs, and backhaul to a plant network from gateways and other devices with high data throughput. Wireless process transmitters on the other hand use WirelessHART based on IEEE 802.15.4 for smaller data volume, designed specifically to conserve power enabling transmitters to operate on batteries for several years. WirelessHART and Wi-Fi standards complement each other in the industry just as Bluetooth and Wi-Fi complement each other at home and in the office.

A wireless field network is pure digital communication which can be used where running a bus to instruments is costly or impractical. Just as for bus technologies, there are different ways to do wireless depending on the requirements to be met.

Standards lessons

One thing we learned from the fieldbus standardization effort is that industry consortia like the HART Communication Foundation, Fieldbus Foundation, and PNO (for Profibus) can keep up with technology developments thanks to frequent meetings and shorter review periods than larger standardization bodies. They can therefore complete their work sooner, before the national and international standards are written and approved. Once the development work is done, the standards organization approves the ready technology.

The so-called “fieldbus wars” were focused mainly on the data link layer of the protocol. For wireless field networks the there will be no “fight” on which is the best physical layer and data link layer. It is already clear that it is IEEE 802.4.15, and for higher level networks it will be the IEEE 802.11 family of standards. Because of their different requirements, wireless for factory automation is likely to be different from the wireless in process control.

For wireless technologies the differentiation will be at the “application layer”. WirelessHART uses the same commands as wired HART, trusted by manufacturers and users alike because of the interoperability provided over more than a decade.

WirelessHART is currently the only interoperable protocol for wireless field networks and is fast becoming the de-facto standard as one manufacturer after another announces products based on this standard and support in control systems. Many plants have already adopted WirelessHART for their wireless field network infrastructure. IEC standardization is progressing and has already achieved status as IEC/PAS 62591.

Throughout the plant

Adoption of fieldbus has moved fastest for “complex” devices like drives and electric actuators that previously required many signal wires. Leading corporations are using fieldbus for devices throughout plants including control valves, analyzers, and transmitters. EDDL makes bus technologies easier to use by integrating multiple protocols in the same software to manage all devices from a single location, presenting essential device information “on top”, providing user guidance, and step-by-step wizards.

Interoperability between a broad array of fieldbus products from different manufacturers has improved greatly thanks to ever more rigorous testing of devices and systems. Over the past 10 years, many refinements have been made to the different fieldbus technologies, products, and systems, including simpler solutions for hazardous areas, specialized troubleshooting tools, and engineering guidelines.

Jonas Berge, is Director of PlantWeb Consulting, Emerson Process Management

--------------------------------------------------------------------------------------------

-----------------------------------------------------------------------

Going Beyond the Barrier

Andreas Agostin compares the common fieldbus barrier topology with a redundant FISCO solution and concludes that with regards to safety, complexity and reliability, the latter comes out on tops.

High energy trunk method (or high power trunk method, or fieldbus barrier topology, which all refer to the same technology) was often promoted as the ultimate fieldbus topology, due to its capability of providing more power to field instruments and allowing the use of redundant fieldbus power supplies in applications with intrinsically safe instruments.

In most cases, High Energy Trunk consists of a redundant fieldbus power supply located in the control room, and three fieldbus barriers located in a field junction box. (See Figure 1)

A fieldbus power supply is a galvanically isolated power source followed by a power conditioner necessary to power a fieldbus segment combined in one device. In between, there is the trunk cable (also called homerun), which extends to several hundred meters. Fieldbus barriers are galvanically isolated Megablocks; wiring blocks which feature a galvanic isolation suitable to connect up to four intrinsically safe field instruments via intrinsically safe spurs.

Intrinsic safety (IS, Ex i) is a protection method for potentially explosive (hazardous) areas. It is the only protection method that operates electrically versus all other protection methods such as Ex p, o, q, m, e, d, n (except Ex nL, which is similar to IS), which operate mechanically. It was first defined in the British Standard BS1259 in 1945 and is now covered by EN 50020 and IEC 60079-11.

Today’s standards permit two methods for approvals: the system approach, where all components of a system are certified as one and no further changes are permitted, or the parametric or “Entity” approach, where individual components are certified with safety parameters which then are used in a calculation to verify that the actual interconnection is safe.

In fieldbus, Entity simply means that a device is intrinsically safe. Entity limits the electrical energy that is provided into the hazardous area. The available energy is enough to power a field transmitter, a solenoid, a fire & gas detector, and other pieces of equipment. Figure 2 shows the topology of an intrinsically safe network. The difference compared to high energy trunk method is that the isolator is located in the control room, not in the field.

Using intrinsic safe equipment in a hazardous area application requires the operator to verify that what they interconnect is really intrinsically safe. One might think: “Ok, I’ve got an IS isolator here, and there is the IS field instrument, so that is intrinsically safe.” But there are more IS relevant parameters other than voltage (U), current (I) and power (P). There is capacitance (C) and inductance (L).

Figure 3 shows such an Entity network. The isolator (typically mounted in the safe area in the control room) owns the parameters U0, I0, P0, C0 and L0, the field instrument the parameters Ui, Ii, Pi, Ci and Li. Other pieces of equipment that are connected to the loop own such parameters, too. This includes the cable, which owns a CC, LC and RC. In most cases, CC and LC are relevant, whereas in some cases the ratio LC/RC is relevant. For simplicity, we will consider the regular case only.

The IS isolator (or barrier, which does not contain galvanic isolation) works as a power supply towards the field instrument. Under fault conditions (for Ex ia: two faults; for Ex ib: one fault) it may output a maximum voltage U0, maximum current I0 and maximum power P0 to the field. These maximum values are called “safety parameters”, and they are limited to maximum values that will not cause an explosion in the event of a fault in the system. It is obvious that even under fault conditions, the isolator must not cause harm to the field instrument, which otherwise could cause an explosion. This leads us to the first set of formulae: U0 ≤ Ui, I0 ≤ Ii, P0 ≤ Pi.

For explanation, the meaning of U0 ≤ Ui is that the maximum worst case output voltage of the isolator must be less or equal to the acceptable voltage of the field instrument. Otherwise, if the isolator can deliver more voltage than what the instrument can accept, it might damage the instrument. This would not be intrinsically safe. The same logic applies to the current and power limits.

Capacitance and inductance are energy storing components. Energy stored in an inductor depends on the current , energy of a capacitor depends on voltage. As such, the isolator safety parameters U0, I0 and P0 also determine the amount of connectable capacitance and inductance. Field instruments may or may not contain capacitances and inductances. The sum of all connected energy storing components must be less or equal than what is allowed to be connected to the isolator. This includes the cable, which is considered as a lumped capacitance and lumped inductance of CC and LC. This results in the second set of formulae: C0 ≥ Ci + CC, L0 ≥ Li + LC.

For explanation, the meaning of C0 ≥ Ci + CC is that capacitance of the field instrument plus cable capacitance must be less or equal to the capacitance allowed to be connected to the isolator. Otherwise, if more capacitance is connected than what the isolator allows, the connected capacitance can cause an explosion. This would not be intrinsically safe.

In the late 1980s, control equipment started to be interconnected with networks, such as Profibus, LON, WorldFIP, etc. In 1994, ISP and WorldFIP (North America), two competing technology organizations, merged into today’s organization promoting networked field instrumentation, the Fieldbus Foundation.

In the early 1990s, industry and end users evaluated the potential of fieldbus technology and found that using intrinsic safety for bus-connected field instruments was drastically limiting the number of connectable devices. For Ex ia IIC, approx. 80 100 mA are available at a voltage (around 12- 14 V), which is reasonable to cover some hundred meters. Technically, more current could be available but only at reduced voltage, so that the achievable distance would be very short.

The other aspect that is limiting the use of Entity in fieldbus applications is the verification of intrinsic safety. The simple comparisons U0 ≤ Ui, I0 ≤ Ii and P0 ≤ Pi already pose a problem to fieldbus applications. The various instrument manufacturers used different safety parameters, and so did the manufacturers of the isolators (now called fieldbus power supplies). As a result, an instrument could be connected to the supply of one manufacturer, but not to the supply of another.

The worst calculation, however, was the calculation of capacitance and inductance. While previously, there was one field instrument and one cable, with fieldbus there are now several field instrument and several cables. Hence the formula that needed to turned into: C0 ≥ ΣCi + ΣCC, L0 ≥ ΣLi + ΣLC.

All capacitances of all the instruments and all the trunk cables and spur cables needed to be added up. And if one device was replaced by another, or one cable distance changed, or one device added, the whole calculation had to be performed again, a tedious and tiring process which no-one wanted to undergo. The reality was an incorrect calculation or no calculation at all. Industry, users and the German certification institute PTB started looking for a solution. What emerged became known as FISCO.

The FISCO formula

FISCO is the abbreviation of Fieldbus Intrinsically Safe Concept. First and foremost this means that FISCO is still intrinsically safe. But the goal of FISCO is to provide higher power into the hazardous area, and to simplify the verification of intrinsic safety. To find out how can these goals be achieved we have to review what makes IS complicated.

The complication of applying Entity on fieldbus networks comes from

1. The various incompatible manufacturer-dependent safety parameters, which makes the comparison tedious.

2. Capacitances and inductances of field instruments, which require a detailed calculation and prevents changes or extensions to the network.

3. Capacitances and inductances of the cable, which requires calculation each time the network is changed.

4. Limited power, as the isolator (fieldbus power supply) must allow for capacitances and inductances, so that the voltage, current and power must be lower than without such energy storing components.

Overcoming the first problem was easy: standardize the parameters, and the problem is solved. FISCO standardizes on 17.5 V, 380 mA and 5.32 W. To overcome the second problem, field instruments had to eliminate countable capacitances and inductances. This is technically possible, and FISCO requires all devices to have negligible inductance and capacitance.

The third problem appeared to be more difficult, but the German PTB started to look at a cable as what it really is: a concatenation of tiny capacitors, inductors and resistors, so-called distributed reactances. It then conducted a series of tests to verify that cable indeed can be considered as distributed reactance. As a result, they found that (fieldbus) cable has no impact on the ignition probability, provided spurs are not longer than 60 m and the total cable distance is not more than 1000 m (IIC) or 5000m (IIB).

With devices having negligible small capacitance and inductance and cable having no impact on the ignition probability either, all energy storing components were removed out of the fieldbus network. This meant that more energy can be provided into the hazardous area compared to networks where such energy storing components must be considered.

Together with the standardization of the safety parameters, this completely eliminated the need to perform a verification of intrinsic safety, as long as all components comply with FISCO (Figure 4). FISCO soon was accepted from certification institutes around the globe and was standardized in the IEC 60079-27.

The Fieldbus Foundation website lists 293 devices. Out of the 233 valid field instruments, a representative selection of 123 was investigated for type (FISCO/Entity) and current consumption: 85 field instruments are intrinsically safe certified according to both the Entity and FISCO standard; 8 are FISCO certified only, 7 instruments are Entity certified only; and 23 instruments do not have an intrinsically safe certificate at all. Even though the investigation so far covers only 53 percent of valid field instruments, it becomes obvious that FISCO compliance is the standard for field instruments, and it is unnecessary to rely on Entity instruments.

According to Ohm’s law, the resistance RC of the cable must be limited so that the device current flowing through the cable causes a voltage drop small enough to have sufficient supply voltage available to operate the field instruments. Alternatively, at a given cable resistance, less field instrument current will cause less voltage drop. Low instrument current is hence beneficial in order to achieve longer cable distances and to connect more field instruments to a fieldbus network.

In the past, manufacturers and organizations dominantly used 20 mA as the average current in fieldbus power calculations, partly because the current was assumed to be in this range, and partly because it was easier to perform “back of the envelope” calculations while retaining a conservative margin for future growth.

For this article, 123 of the 233 FF-listed field instruments were investigated concerning their current consumption, and the calculated average is 15.29 mA. This is significantly lower than the assumed 20 mA, and hence has great impact on the design of fieldbus networks. In addition, more than 63 percent of devices have a current consumption of 15 mA or less.

Comparing connections

A drawback with fieldbus barriers is the complicated design of the field junction box. Figure 5 shows a typical design, similar to what was used in the world’s largest fieldbus barrier installation in India in 2008.

A fieldbus barrier, as mentioned above, is an isolated fieldbus power supply with four intrinsically safe outputs; in simple terms: plenty of electronics in the field, hence the surge protection (1); a cable duct (2) is used to tidy up the box wiring; external terminals (3) are used so that the technician does not have to access an electronic module directly; an external terminator (4) with built-in surge protector for the trunk; trunk connection (5) using explosion protection method Ex e (increased safety); spurs (6) that are intrinsically safe; Ex de disconnect switches (7) located in a smaller adjacent compartment, together with the incoming Ex e trunk wiring (8); and a ground bar (9) to connect trunk and spur shields, so that the shield is continuous from control cabinet to field.

In a FISCO network (Figure 4), all connected equipment has to comply with the FISCO standard. This includes FISCO supplies, FISCO terminators, and FISCO instruments. Cable is a “simple apparatus” and hence does not require certification. The only condition is that the cable parameters match the FISCO requirements, and since FISCO was based on typical instrumentation cable, every available fieldbus cable does. Entity devices can also be connected using “spur connectors”, small terminals which incorporate a resistor to lower the safety parameters to Entity levels.

Redundant FISCO does not differ in topology from non redundant FISCO; the difference is that instead of a single FISCO supply a redundant version is used. A redundant FISCO supply not only consists of two FISCO supply modules, but also two supply arbitration modules. Without SAM, two interconnected FISCO supplies would deliver twice the output power, which would no longer be intrinsically safe. The SAMs have to ensure that at any time, only one supply is powering the field segment, so that the output power is limited to the same level as a single FISCO supply.

The additional space required by redundant FISCO is more than compensated by the reduced risk due to full intrinsic safety on trunk and spurs and no mixture of protection methods in the field junction box. In comparison, the High Energy Trunk method (fieldbus barriers) uses a mixture of protection methods in the field junction box, which poses a risk to plant operators. When compared to FISCO or redundant FISCO networks, fieldbus barriers represent the least reliable solution.

With FISCO power supplies, the field junction box (Figure 6) turns out very simple: solutions range from a simple terminal strip to dedicated fieldbus wiring blocks which provide built-in short circuit protection for a reliable network. The primary advantage is the risk-free operation of such a box; all connections are intrinsically safe, so that any wire can be touched, shorted, or disconnected at any time without causing an explosion. This is especially important with fieldbus networks where devices must be connected to a network during maintenance. A junction box for FISCO networks also does not require approval other than those already obtained for the individual components. All this turns a FISCO network into an economically efficient solution.

Reliability comparison

With the fieldbus barrier, the most complex part of the fieldbus physical layer - the isolator unit - is located in the hazardous area, where maintenance and replacement are likely to be more difficult. Being field-mounted, it is also subjected to environmental conditions, such as extremes of temperature, which will conspire to reduce its life. The fieldbus barrier itself is not redundant, so any failure will lead to failure of communication of up to four devices and in some cases even all devices on the segment. And while the fieldbus power supply to the trunk can be made redundant, the trunk itself is still vulnerable to single points of failure.

The architecture of the MTL (redundant) FISCO implementation is inherently reliable. The only components in the hazardous area are the wiring termination blocks (Megablock) which, being simpler and having no common components for the respective number of connectable devices, have a longer Mean Time to Failure (MTTF) than the fieldbus barrier unit. The FISCO power supply itself is a high-reliability device that typically is operating in a control room environment.

The combination of FISCO supplies which are mounted in the controlled environment of an interface room and associated Megablocks have an MTBF of 192 years @ 35ºC.

The High Energy Trunk/fieldbus barrier with its associated electronics in the field where temperatures fluctuate more widely has an MTBF of approximately 100 years @ 50ºC. Therefore for every 12 devices, non-redundant FISCO sourced installations will statistically affect 0.06 devices in a year while fieldbus barrier solutions will have double the impact, affecting 0.12 devices a year. The result is that FISCO is two times more reliable than fieldbus barrier.

The reliability of the power supply in a redundant FISCO system is so high it can be neglected, so that only the MTBF of the Megablock becomes relevant. With an MTBF of more than 300 years, statistical failure rate is 0.04 devices per year and this is three times more reliable than fieldbus barriers.

Redundant FISCO steps up to bridge the gap that made High Energy Trunk popular: it now provides redundancy for the fieldbus power supply. Having redundancy and full intrinsic safety at the same time, there is no longer a need to compromise on safety and reliability. Having proven the actual average current consumption of field instruments to be close to 15 mA and hence significantly lower than previously assumed (20 mA), the distance problem of FISCO becomes negligible, since lower current also means less voltage drop at the trunk and hence longer distance. Slightly thicker cable can easily compensate the remaining missing trunk length. Redundant FISCO makes use of simple field junction boxes with Megablocks, which easily compensates for the costs of thicker cable that may be required in some cases, and provides the highest fieldbus reliability of all topologies.

Andreas Agostin is Industrial Networks Regional Sales Product Specialist, MTL Singapore, and has been an active member in the promotion of Foundation fieldbus and Profibus technology in Asia Pacific.

-----------------------------------------------------------------------

--------------------------------------------------------------------------------------------

Fault-Tolerant Fieldbus Technology

A fault-tolerance approach to Foundation fieldbus segment design can yield dramatic economic benefits for plant operators. By Desmond Ho.

It is almost ironic; network cables in the benign, wellmanaged control room environment are almost always made redundant whereas field cables exposed to the harsh and sometimes corrosive environment of the modern industrial plant have to fend for themselves. Of course, when the field cables carried simple point-to-point communications as 4-20mA, then redundancy wasn’t really a concern in general, and specific devices could be duplicated as required.

However, now that the lowest fieldbus physical layer carries data from up to 32 devices, the vulnerability of that cable can constitute a reliability issue, particularly if those devices are safety-related or process-critical.

Conventional fieldbus segment design does not lend itself to any version of fault-tolerance except through complete and wholesale duplication, and in a systems context, that duplication brings with it a requirement for ‘special’ software to implement 1oo2/2oo3 voting schemes and special measures for safe maintenance, device replacement, etc.

In 2007, a new fault-tolerant segment design was released that permits a far higher segment MTBF than conventional designs without any special software in the DCS and for only the additional cost of an extra trunk cable. Working with a major DCS company and a major oil & gas company, this package was installed on a set of platforms in the South China sea to mitigate the huge financial risk associated with loss of control. The question is, does this increase in availability really make any significant difference to the economics of the general fieldbus installation?

Segment design issues

The answer is not a simple yes or no, because a fault-tolerant system allows a user to make permutations that match the desire for high plant availability against a budget for the systems hardware. These permutations (simplex v duplex v fault-tolerant) were not possible in previous fieldbus physical layer products.

The standard segment design process takes two controllers (H1 cards), two power conditioners and connects to the field using a single cable. This can be called a duplex segment design. Based on conventional MTBF data books and data from other sources, we can evaluate the MTBF of such a segment. Figure 1 shows such a segment and the physical layer components in that configuration give a calculated MTBF of some 50 years.

Some users also admit to the possibility that some FF devices are not that critical to plant operation, and that these devices can be connected via a single controller. If this were to be allowed, a new segment design could be used, called a simplex segment. The physical layer components in that configuration give a calculated MTBF of some 30 years. Regrettably, very few project specifications allow for simplex segments, which may be because most vendors only offer duplex segments.

The fault-tolerant design utilizes a unique power conditioner that can detect open-circuit and short-circuit conditions in the field at up to 1000 m of standard cable. It is matched to a field wiring hub that can react to the loss of a trunk cable (out of an active pair) by automatically terminating the segment via the remaining cable.

It may be a surprise to many but standard power conditioners do not effectively detect field short-circuits over a couple of hundred metres and, when faced with a remote short-circuit, the standard power conditioner simply tries to drive into what it thinks is a high load, getting progressively hotter and hotter until premature failure.

The fault-tolerant segment design takes two controllers, two advanced power conditioners and a high-integrity wiring hub, but connects to the field with two trunk cables, one per power conditioner. The segment layout is as indicated in the diagram, and the calculated MTBF is around 350 years. This is a factor of 10x the simplex segment, and 7x the duplex segment, for the cost of an extra cable.

Significantly, this version of fault-tolerance does not depend upon monitoring and switching mechanisms. Both trunks are continuously active as opposed to the alternative “one active, one hot spare” configuration. Designing systems for redundancy using watchdogs and switches is inherently complex and rarely result in improvements in MTBF, since the failure rate of the switch acts against the parallel failure rate of the “spare” trunk.

This version of fault-tolerance meets the requirements of FF Safety Instrumented Systems since there are very few un-revealed faults, and the highly critical ‘Probability of Failure on Demand’ factor is kept low by continuous diagnostics and simple nondestructive testing – unplugging one of the trunk cables annually demonstrates the safety functionality in a similar fashion to partial stroke testing of shutdown/isolation valves.

Segment design costs

This analysis is based on a plant with 120 segments, or about 1440 fieldbus instruments, such as flow transmitters, valve controllers, etc. This plant can be described in terms of how many segments are related to control of the plant, and how many are related to simple monitoring. Let’s say that 80 segments are monitoringonly and 40 segments have control. Of the 40 control segments, 12 segments have loops which are process-critical: failure in any of those segments would cause immediate plant shut-down orproduct that was out of specification.

Let’s assume the following prices for fieldbus equipment which are typical across the industry from physical layer vendors:

$240 – Carrier, 4-segment, Simplex

$320 – Carrier, 4-segment, Duplex

$280 – Carrier, 4-segment, Fault-Tolerant

$390 – Power Conditioner

$450 – Diagnostics Module, Standard

$350 – Standard Coupler, 12-spur

$700 – High-Integrity Coupler, 12-spur

$500 – Trunk cable

Then we can compare costs between the conventional design and the new approach:

Conventional segments

30 x $320 Carriers, 4-segment, Duplex (1 per 4 segments)

240 x $390 Power Conditioners (2 per segment)

30 x $450 Diagnostics Module, Standard (1 per 4 segments)

120 x $350 Standard Coupler, 12-spur (1 per segment)

120 x $500 Trunk cable (1 per segment)

Total (conventional): $218,700

Simplex segments

20 x $240 Carrier, 4-segment, Simplex (1 per 4 segments)

80 x $390 Power Conditioner (1 per segment)

20 x $450 Diagnostics Module, Standard (1 per 4 segments)

80 x $350 Standard Coupler, 12-spur (1 per segment)

80 x $500 Trunk cable (1 per segment)

Duplex segments

7 x $320 Carrier, 4-segment, Duplex (1 per 4 segments)

56 x $390 Power Conditioner (2 per segment)

7 x $450 Diagnostics Module, Standard (1 per 4 segments)

28 x $350 Standard Coupler, 12-spur (1 per segment)

28 x $500 Trunk cable (1 per segment)

Fault-tolerant segments

6 x $280 Carrier, 4-segment, Fault-Tolerant (2 per 4 segments)

24 x $390 Power Conditioner (2 per segment)

6 x $450 Diagnostics Module, Standard (2 per 4 segments)

12 x $700 High-Integrity Coupler, 12-spur (1 per segment)

24 x $500 Trunk cable (2 per segment)

Total (new approach): $198,170

System savings

The conventional approach for 120 segments takes 240 power conditioners.

The new approach allows savings for the 80 monitoring-only (simplex) segments as these have only one power conditioner. Of course, the conventional system could also fit single power conditioners but since they still have duplex carriers, two power conditioners are fitted by everyone as a matter of routine.

The duplex segments have dual power conditioners as is common practice, and the fault-tolerant segments also have two power conditioners but physically separated onto different carriers and connected to the field through 2 cables. In total, the new approach has 160 power conditioners.

The net result is that this new approach leads to lower equipment costs, even when allowing for the additional trunk cable used in the fault-tolerant segment layouts. The savings may be greater still; many end-user specifications restrict process-critical segments (“level 1” criticality) to having just one valve and one transmitter in that segment. It seems ridiculous to install a fieldbus segment with just two devices, but in the conventional single-trunk configuration, that is deemed necessary to minimise the risk of accidental plant shutdown.

Operational savings can also be added into the equation, since the spurious trip rate due is reduced with a fault-tolerant fieldbus system when compared with a standard fieldbus system. In fact, the OPEX savings can be calculated at $400,000, given the cost of a spurious trip in a plant of this size is $250,000, a spurious trip rate of once every five years for a standard fieldbus system, and once every 25 years for a fault tolerant system.

It seems clear then that this approach to segment design does not increase costs over a conventional one-size-fits-all design; when the concept is properly applied, it actually costs less – $433,441 over 10 years.

Foundation fieldbus systems can now incorporate redundancy and fault-tolerance right down to the field layer (FF-H1). The major impact is on project ROI and plant revenues, and only Foundation technology can offer this level of security and benefit to the plant operator.

The resulting improvement in real plant availability creates still greater benefit for the plant operator, and the positive cash flow generated is both dramatic and undisputable. Prospective fieldbus users now have further evidence that Foundation technology will be an advantage for their plant and their management, and the uptake rate for can only increase further, to dominate the landscape for industrial networking and process control.

Desmond Ho is General Manager, China, Moore Industries-International.

--------------------------------------------------------------------------------------------