🎓 Lesson 5
D3
PRP/HSR vs. Dual-Fiber Ring: Failure Mode Comparison
PRP/HSR and Dual-Fiber Ring are two different ways to build backup paths in industrial control networks so that if one cable breaks or a switch fails, the SCADA system keeps running without interruption.
🎯 Learning Objectives
- ✓ Analyze failure modes of PRP, HSR, and Dual-Fiber Ring under single-point and dual-point link failures
- ✓ Explain the impact of each architecture on SCADA message latency, jitter, and determinism
- ✓ Design a network resilience strategy by selecting the appropriate topology based on SIL2/SIL3 requirements and MTTR constraints
- ✓ Calculate mean time to detection (MTTD) and mean time to restore (MTTR) for each topology using IEC 62439-3 Annex C methodology
📖 Why This Matters
In mining and blasting operations, SCADA systems monitor blast initiation circuits, gas detection, conveyor status, and ventilation—all safety-critical functions. A 100-ms network outage can cause misfired detonators, unsafe air quality exposure, or uncontrolled material flow. Understanding how PRP, HSR, and Dual-Fiber Ring respond to physical layer faults (e.g., backhoe cutting fiber, lightning-induced switch reset) directly impacts functional safety compliance (IEC 61511), regulatory audit readiness (MSHA Part 46/47), and operational continuity during high-risk blasting sequences.
📘 Core Principles
PRP achieves zero-recovery-time by connecting each device (e.g., PLC, RTU) to two independent Ethernet LANs (LAN A and LAN B). Frames are duplicated and sent simultaneously; the receiving node accepts the first arrival and discards the duplicate. HSR forms a closed ring where every node forwards two copies of each frame—one clockwise, one counterclockwise—and eliminates duplicates only at the destination node using sequence numbers. Dual-Fiber Ring uses two counter-rotating fiber rings but relies on proprietary protocols (e.g., Siemens RSTP+, Rockwell Stratix DFR) that require STP/RSTP convergence, introducing detectable delay during topology changes. Unlike PRP/HSR, DFR lacks standardized frame elimination logic, leading to variable recovery behavior across vendors and potential packet reordering under stress.
📐 Mean Time to Detection and Restore (MTTD/MTTR) Comparison
IEC 62439-3 defines MTTD as the maximum time from fault occurrence to detection, and MTTR as time to full service restoration. For PRP/HSR, MTTD = 0 (faults detected via heartbeat loss within < 3 ms); MTTR = 0 (no switchover delay). For DFR, MTTR depends on STP convergence: MTTR ≈ 3 × Hello_Time + 2 × Forward_Delay. This formula enables quantitative comparison of resilience performance.
💡 Worked Example
Problem: A Dual-Fiber Ring uses IEEE 802.1D STP with Hello_Time = 2 s and Forward_Delay = 15 s. Calculate worst-case MTTR after a link failure.
1.
Step 1: Identify STP parameters per IEEE 802.1D: Hello_Time = 2 s, Forward_Delay = 15 s
2.
Step 2: Apply MTTR ≈ 3 × Hello_Time + 2 × Forward_Delay = 3×2 + 2×15 = 6 + 30 = 36 s
3.
Step 3: Compare to PRP/HSR MTTR = 0 ms — this 36 s gap exceeds SIL2 requirement (< 100 ms) for safety-related communications per IEC 61508-2 Table 12.
Answer:
The calculated MTTR is 36 seconds, which violates SIL2 timing constraints and renders DFR unsuitable for safety-critical SCADA interlocks without protocol enhancements.
🏗️ Real-World Application
At Newmont’s Boddington Gold Mine (Western Australia), a 2021 SCADA upgrade replaced legacy Dual-Fiber Ring (Rockwell Stratix 8000) with HSR-enabled switches (Hirschmann RSPE30) on the blast initiation network. During commissioning, intentional fiber cuts were performed: DFR exhibited 32–41 s recovery (confirmed via Wireshark timestamp analysis), causing timeout alarms in the blast sequencer; HSR showed zero packet loss and deterministic 12 µs jitter. Post-deployment, MSHA audit confirmed HSR met IEC 62439-3 Clause 7.2.3 for 'zero-recovery-time redundancy' — enabling SIL3-rated initiation integrity per IEC 61511 Annex D.