Automation system architecture and availability

Designing an automated system (a bottling line, a water treatment plant, a robotic warehouse) means much more than writing a program for a PLC: sensors and actuators, networks, controllers and supervisory systems must be chosen, people’s safety guaranteed, and a plant delivered that will work for twenty years. In this lesson we look at the layered architecture of an automation system, the project life cycle, and system availability with the formulas for components in series and in parallel proved and an example.

The automation pyramid

Industrial systems are organised in levels, according to the model of the ISA-95 standard (IEC 62264):

• level 0, the field: sensors (temperatures, pressures, positions) and actuators (motors, valves, cylinders), with times of the order of milliseconds;
• level 1, control: PLCs, controllers, drives, executing logic and regulation (Process Control lesson on PLCs);
• level 2, supervision: SCADA (supervisory control and data acquisition) with operator stations, alarms and data history;
• level 3, production management: the MES (manufacturing execution system) follows orders, batch traceability, quality and efficiency (lesson on commissioning);
• level 4, the enterprise: the ERP handles orders, warehouse, purchasing and accounting (Business Management lessons).

Going up, data are more aggregated and times longer; going down, the requirements for determinism and reliability grow. Today the levels are converging (Industry 4.0): field data go directly to analytics systems and the cloud through protocols such as OPC UA (lesson on industrial networks), and cybersecurity becomes part of the design.

The project life cycle

An automation project usually follows the V model:

1. requirements specification: what the plant must do, with what performance, under what environmental conditions, under which standards;
2. risk analysis: what hazards exist for people and the plant, and which safety functions are needed (lesson on functional safety);
3. functional specification: sequences, control loops, alarms, operator interfaces;
4. design of the hardware (electrical panels, choice of sensors, actuators, controllers and networks) and the software;
5. implementation;
6. on the rising branch, the verifications corresponding to each step: module tests, integration tests, factory acceptance test (FAT) and site acceptance test (SAT), validation against the requirements.

Every requirement must be verifiable, and every test must trace back to a requirement: requirements traceability is often required by the customer and, for safety functions, by the standards.

Availability

For a production plant the most important quantity is often availability: the fraction of time it works. If a component fails on average after a time MTBF (mean time between failures) and repair takes on average MTTR (mean time to repair), the availability is

because in each failure-and-repair cycle the component works for MTBF out of a total of MTBF + MTTR. Example. MTBF = 50,000 h and MTTR = 4 h give . Reducing repair time (spares in stock, clear diagnostics) increases availability as much as increasing reliability.

Theorem. With independent failures, a system of components in series (it works only if all work) has availability ; a system of components in parallel (it works if at least one works) has availability .

Proof. is the probability that component works at a randomly chosen instant. In series the system works if all work, and by independence the probability is the product. In parallel the system is down only if all are down, with probability , and availability is the complement (Signal Theory lesson on probability). ∎

Example. A cell with a PLC (), network () and I/O station () in series has : about 22 hours of downtime a year. Duplicating the PLC with a second one in hot standby, the equivalent PLC has , but the system only reaches , about 13 hours: now the network and the I/O weigh. Redundancy must be placed on the weak links, and the chain is as strong as its weakest link. The formulas hold if failures really are independent: two PLCs fed by the same power supply are not.