The Process Industry has quite different requirements from Factory Automation. Generally, we are dealing devices that are exposed to the environment. Requires higher IP ratings. Hazardous environments (explosive atmospheres) are common. Requires Intrinsic Safety. We are often dealing with extensive systems with thousands of devices. Requires high availability. High speed operation is not normally required. Production cannot normally be stopped, so engineering activities such as maintenance and device replacement must have minimum impact.

1. System Design
for the Process
Industry
Andy Verwer,
Verwer Training
& Consultancy
Ltd
Accredited PI
Training Centre
Practical Aspects of
PROFIBUS and
PROFINET in
Process. Held at
Endress+Hauser
Manchester, 29th
June 2016
System Design for the Process Industry, Andy Verwer, page 2Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Process Industry Requirements
The Process Industry has quite different requirements from
Factory Automation.
Generally, we are dealing devices that are exposed to the
environment.
Requires higher IP ratings.
Hazardous environments (explosive atmospheres) are common.
Requires Intrinsic Safety.
We are often dealing with extensive systems with thousands of
devices.
Requires high availability.
High speed operation is not normally required.
Production cannot normally be stopped, so engineering
activities such as maintenance and device replacement must
have minimum impact.

2. System Design for the Process Industry, Andy Verwer, page 3Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
System costs
Most system designers and project managers look at the
project procurement, installation and deployment costs when
they price a project.
However, the costs of an automation system spread over the
life cycle of the plant and should include maintenance, fault-
finding and health-checking.
Perhaps most important is the cost in terms of loss of
production should faults develop during the lifetime of the
plant. Spending a little more at procurement time can repay
many times over.
Good fault tolerant design need not be more expensive.
Sometimes fault tolerance can be achieved with just a little
thought at no additional cost.
System Design for the Process Industry, Andy Verwer, page 4Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Life cycle costs
The procurement,
installation and
commissioning
costs are only
incurred at the start
of the project.
Costs from device
failures increase as
equipment gets
older.

3. System Design for the Process Industry, Andy Verwer, page 5Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Control system design
Control system design normally proceeds by building on the
experience obtained from previous designs.
But, designs which are based on badly designed systems will be
bad!
Only by using experience from operations and maintenance
staff can we develop good system designs.
In my experience it is rare for such feedback mechanisms to be
present. Particularly when design is carried out by sub-
contractors.
Designers need to know about mistakes that have been made
in the past.
Feedback from operations and maintenance is essential.
System Design for the Process Industry, Andy Verwer, page 6Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
System costs
Maximising plant availability is critical in reducing the total
costs of the system. It is essential that the System Designer
understands:
That minimising plant down time when faults inevitably
occur (i.e. maximising plant availability) is a key
requirement.
The impact of the network layout on plant reliability.
That the incorporation of network health checking and
fault finding facilities are essential.
How to appropriately use features such as redundancy and
network monitoring and rapid fault location and repair to
improve plant availability.

4. System Design for the Process Industry, Andy Verwer, page 7Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
The parts of a control system
will fail whilst in service.
The consequences of failures
are often predictable, but the
failures themselves are
unpredictable.
The design of a reliable
control system is not simple.
… and should be
accompanied by analysis of
how parts fail and of the
consequences of these
failures.
Cost of failures
System Design for the Process Industry, Andy Verwer, page 8Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Minimising the failure footprint
There are three basic ways to minimise the impact of faults:
1. Make failures less likely – Minimise the Fault Frequency.
2. Restrict the Fault Effect when failures inevitably occur.
3. Minimise the Fault Duration – Provide for rapid fault location
and repair.
All three have to be considered at the design stage!
A good network design will minimise the effect on production
when inevitable failures occur. We can speak of minimising
the “failure footprint”.
Fault
frequency
Fault
effect
Fault
duration

5. System Design for the Process Industry, Andy Verwer, page 9Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Minimising the failure footprint
Understand and implement the design and installation rules.
Improve reliability – specify good quality well tested (certified)
and reliable devices, connectors and network components.
Use manufacturers who carry out burn-in testing on devices.
For PROFIBUS - use the lowest possible bit rate that gives the
required performance.
1. How can we minimise Fault Frequency?
Fault Frequency
System Design for the Process Industry, Andy Verwer, page 10Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Minimising the failure footprint
2. How can we minimise the Fault Effect?
Analyse the effects of failures on plant operation.
Use well thought out network layout and design.
Think about:
Using separate networks or different controllers
(distributed control),
Using separate wiring (segments) for different parts of the
process,
How best to deal with common cause failures (like power
supply failure, pipe blockages, EMC problems etc.).
Fault
Effect

6. System Design for the Process Industry, Andy Verwer, page 11Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Minimising the failure footprint
3. How can we minimise the Fault Duration?
Provide facilities in the design for rapid fault diagnosis and fault
location.
Fault monitoring is a good solution.
Provide in the design for device hot swapping without
reconfiguration.
Use designs that allow for a quick fix.
Provide redundancy when appropriate. Needs to be well
thought out however!
Use standardised, vendor independent solutions rather than
being locked into manufacturer specific solutions.
Fault
Duration
System Design for the Process Industry, Andy Verwer, page 12Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Reliability and availability
Reliability is a measure of how a component, assembly or
system will perform its intended function, without failure, for
the required duration when installed and operated correctly in
a specified environment.
Availability is a measure of reliability indicating the fraction of
time in which a device or system is expected to operate
correctly.
It is important to remember that reliability and availability are
statistical measures: they will not predict when a particular
device will fail, only the expected rate based on average
performance of a batch of test devices or on past
performance.

7. System Design for the Process Industry, Andy Verwer, page 13Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Some definitions
Mean Time Between Failures (MTBF) is the expected or
average time that a device will be free of failure.
Typical MTBF for a well designed and manufactured electronic
device might be 10 to 20 years.
Mean Time To Repair (MTTR), is the time taken to repair a
failed device.
In an operational system, MTTR generally means time to
detect the failure, diagnose and locate the problem and
replace the failed part.
System Design for the Process Industry, Andy Verwer, page 14Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Availability
Availability can be calculated from MTBF and MTTR:
MTTRMTBF
MTBF
ty,Availabili
+
=A
Remember that availability is a statistical measure and
represents an average probability of being in operation.
There is little point in trying to be accurate with these figures
since actual failures are unpredictable.
Availability is typically specified in “nines notation”. For
example 3-nines availability corresponds to 99.9%
availability. A 5-nines availability corresponds to 99.999%
availability.

8. System Design for the Process Industry, Andy Verwer, page 15Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Availability, A D = (1-A) Downtime
0.9 = 90% (1-nine) 0.1 (10-1) 36.5 days/year
0.99 = 99% (2-nines) 0.01 (10-2) 3.7 days/year
99.9% (3-nines) 0.001 (10-3) 8.8 hours/year
99.99% (4-nines) 0.0001 (10-4) 53 minutes/year
99.999% (5-nines) 0.00001 (10-5) 5 minutes/year
99.9999% (6-nines) 0.000001 (10-6) 5 minutes/10years
99.99999% (7-nines) 0.0000001 (10-7) Not feasible!
99.999999% (8-nines) 0.00000001 (10-8) Impossible!
Downtime is an alternative way of understanding the
availability:
MTTRMTBF
MMTR
AD
+
=−= )1(Downtime,
Availability and downtime
Normalrange
forautomation
System Design for the Process Industry, Andy Verwer, page 16Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Availability and downtime
Note that the availability of a device or system can be
improved by decreasing the MTTR.
This can be accomplished in several ways:
Faster detection and location of faults. (Accomplished by
diagnostic reporting facilities, availability of fault finding
tools and training of maintenance personnel).
Faster repair of the fault. (Accomplished by availability of
spares and all of the above).
Fault tolerant design.

9. System Design for the Process Industry, Andy Verwer, page 17Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Example
Consider a remote IO unit with a MTBF of 10 years.
When the device fails, it could take several days to
recognise, diagnose and locate the fault. And then, if not
held as a spare, several more days to obtain a replacement.
The MTTR could be one week, giving an availability of:
998.0
73650
3650
736510
36510
=
+
=
+×
×
=
+
=
MTTRMTBF
MTBF
A
That is approximately 3-nines availability, or a downtime of
about 16 hours/year.
Consider the availability when the MTTR is reduced to ½ day:
0.99986
5.036510
36510
=
+×
×
=A
The availability is now 4-nines and the downtime has reduced
to about 1hour/year.
System Design for the Process Industry, Andy Verwer, page 18Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Design for minimum fault impact
Use pluggable devices that can be removed/replaced without
impinging on network operation.
For PROFIBUS PA this normally means using tee boxes and
spur lines:
M12 socket
for spur line
Multi-way spur boxes often incorporate
segment protection and/or redundancy options.

10. System Design for the Process Industry, Andy Verwer, page 19Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Design for minimum fault impact
For PROFIBUS DP we can use hubs which provide isolated
segments for sections of the network:
Some of these also provide network health monitoring
facilities and/or redundancy.
System Design for the Process Industry, Andy Verwer, page 20Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
PROFINET system layout
PROFINET systems can be laid out in a number of ways:
Star and tree topologies
using switches:
Line topology using two-port devices:
Or a combination of both.
Switches

11. System Design for the Process Industry, Andy Verwer, page 21Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
PROFINET system layout
There is a clear advantage of the star topology in terms of
system availability in that any device can be replaced without
affecting the other devices.
However, the system cost will be significantly greater because
of the number of switches required.
The line topology is much lower cost, because separate
switches are not required.
But removal or replacement of any device will cause all
downstream devices to fail.
System Design for the Process Industry, Andy Verwer, page 22Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Other ways to improve
availability
We can perhaps use a network layout that allows critical plant
operation to continue in the event of cable/connector failure
or device replacement.
In particular, can we organise the network so that selected
parts can be independently shut down for maintenance
without affecting the remaining production?
A simple example of this is seen with streamed production.
A stream can be taken out of service without affecting the
other stream. But only if the system design allows this.
Process 1 Process 2 Process 3
Stream A
Process 1 Process 2 Process 3
Stream B

12. System Design for the Process Industry, Andy Verwer, page 23Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Automation islands or units
The concept of dividing the plant into Automation Islands or
Automation Units is well established. (See the PI design guides.)
Each automation unit is considered as being functionally
separated from the rest of the plant so allowing it to operate
(and to be shut down) independently.
A good network design will facilitate the isolation of these
automation units using:
• Different controllers;
• Different networks or subnetworks;
• Segmentation.
Careful choice of various architectures for automation units is a
key stage in the design process which can impact on the overall
reliability and maintainability of the control system.
System Design for the Process Industry, Andy Verwer, page 24Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Reliability modelling
The system designer must understand the methods of
modelling and analysis of reliability and availability in systems.
In particular how system availability can be predicted from the
individual parts.
Also understand how standby systems, redundant solutions
and common cause failures impact the overall system
reliability.
We often find that redundancy is inappropriately used and
sometimes results in no real improvement in system
availability.
Careful network layout can have a major effect on the fault
footprint and significantly improve the overall availability of
the plant.

13. System Design for the Process Industry, Andy Verwer, page 25Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Standby and redundant systems
We often see standby or redundant systems used to try to
improve plant availability.
Here we have two or more devices working in parallel.
Should a fault occur in the operational device then the standby
device can take over.
The switch over can be manually activated or can be
automatic. The switching time should be considered when
estimating the overall system availability.
This scheme achieves high availability because the system
function is maintained whilst repairing the failed device.
System Design for the Process Industry, Andy Verwer, page 26Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Multiple controller systems
Multiple PROFIBUS masters or PROFINET controllers with
automatic duty-standby switching are available from a number
of suppliers.
These can drive different networks to provide redundancy
down to the field level. However, separate power supply and
network cable routing are advisable to minimise common-
cause failures.
Sometimes dual slaves can be used in the field with a simple
“wired-OR” voting system driving the final actuator or
connecting two redundant sensors.
However, more often we find such redundant controllers are
using the same field devices and actuators.
Such systems must be carefully designed, taking account of
the consequences of all possible failures.

14. System Design for the Process Industry, Andy Verwer, page 27Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Redundancy solutions for
PROFIBUS
Solutions for redundant PROFIBUS cabling are available from
many manufacturers:
Siemens Y-Link
PROCENTEC ProfiHubs
ABB Redundancy
Link Module
Moor-Hawke
Redundancy for PA
COMbricks modules
System Design for the Process Industry, Andy Verwer, page 28Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Slave with
integrated
redundancy
Y
Slave 4
Slave
3A
Slave
3B
Mechanically
combined outputs
Redundant
slaves
Wired OR
outputs
Slave
2A
Slave
2B
Y
Redundant
masters
Master
B
Y
Redundancy solutions for
PROFIBUS
Properly designed redundant
solutions can provide robustness
against a wide selection of faults
and conditions.
Master
A
Redundant cables
PSU A
PSU B
Redundant
power
supplies
Y
Slave
1
Redundant
links or hubs
Y

15. System Design for the Process Industry, Andy Verwer, page 29Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
One of the big advantages of PROFINET is that it incorporates
a specification for media redundancy.
The standardised Media Redundancy Protocol (MRP) provides
manufacturer independent redundancy which can be used
over copper or fibre cables.
PROFINET redundancy can provide:
• Controller redundancy.
• Transmission media and switch redundancy.
• IO device redundancy.
Redundant PROFINET systems are relatively easy to implement
and can be used across different manufacturers.
Redundancy solutions for
PROFINET
System Design for the Process Industry, Andy Verwer, page 30Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
PROFINET redundancy
Standardised Media Redundancy Protocol (MRP) can be used
on PROFINET systems to give media redundancy.
IO Controller
with MRP
IO Devices
with MRP
Switch
with
MRP
IO Device
without MRP
But the system must still be properly designed, considering
all possible failures and their likelihood. Common cause
failures must be properly dealt with.

16. System Design for the Process Industry, Andy Verwer, page 31Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Device replacement
When a device fails, it must be replaced.
As we have seen, simple and fast device replacement can have a
major impact on the plant availability.
For PROFIBUS devices, this generally means that the
replacement must be of the same type and version.
The device must be given the same address as the device it is
replacing.
However, suppose that the replacement is a newer version or
perhaps even a device from a different manufacturer?
Normally we would need to stop the controller and change the
network configuration to include the different device.
The current PROFIBUS PA profile incorporates a nice feature
which allows PA devices use generic “profile” configuration and
thus allows devices to be exchanged without reconfiguration.
But the initial system must be configured to use these profile
GSD files rather than the manufacturer specific GSD.
System Design for the Process Industry, Andy Verwer, page 32Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
PA Device Replacement
Process Control System
Temperature transmitter configured using
The Profile GSD: “PA139700.GSD”
Temperature transmitter
manufacturer ID = 089A
Alternate profile ID = 9700
Temperature transmitter
manufacturer ID = 1523
Alternate profile ID = 9700
Failed device Replacement device
Replacement device
automatically adapts to the
configured ID

17. System Design for the Process Industry, Andy Verwer, page 33Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
PROFINET Configuration in Run
The latest specification of PROFINET includes so called
Configuration in Run (CiR).
When implemented, this provides the facility to replace a
device with an equivalent device without the need of any
engineering tools.
The device name and IP address are automatically
downloaded from the controller and the new device is
incorporated without any stoppage of the plant.
However, to use this facility, the initial system must have
certain facilities set up (Topology facilities and CiR
enabled). These are features that the system designer
should be aware of.
3
3
System Design for the Process Industry, Andy Verwer, page 34Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Certified System Design course
A new Certified PROFIBUS System Design course was
developed last year and is fully accredited by PI.
This 3-day training course is suitable for managers, designers
and engineers who are involved in the planning, specification,
design and procurement of PROFIBUS systems.
The course covers the optimum design both DP and PA
systems for availability and maintenance.
The 1-day Certified PROFIBUS Installer course is an essential
pre-requisite which is normally run together with the design
course making 4-days of training.
The course is also available for cost-effective on-site delivery
for between 6 and 12 people.

18. System Design for the Process Industry, Andy Verwer, page 35Practical Aspects of PROFIBUS and PROFINET in Process, 29 June 2016
Training
Certified PROFIBUS and PROFINET training including the new
Certified PROFIBUS System Design course is available from the
UK’s accredited training centres:
PROFIBUS International Competence Centre
Manchester Metropolitan University.
in Manchester, or a location of your choice.
(www.sci-eng.mmu.ac.uk/ascent/).
PROFIBUS International Training Centre
Verwer Training & Consultancy Ltd
In Manchester or on-site.
(www.VerwerTraining.com)