More Related Content Similar to Introduction to ControlLogix Redundancy Customer Presentation.pptx Similar to Introduction to ControlLogix Redundancy Customer Presentation.pptx (20) Introduction to ControlLogix Redundancy Customer Presentation.pptx1. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 1
PUBLIC
Introduction to ControlLogix Redundancy
February 2018
2. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 2
PUBLIC
Agenda
Monitoring Redundancy
Redundancy Switchover
How to Enable and Configure
Hardware and Restrictions
Introduction to Redundancy
3. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 3
PUBLIC
Introduction to ControlLogix Redundancy
Dual Chassis Design
Full Redundancy
Both Chassis match
Transparent
Primary/Secondary Chassis
IP Address Swap
ControlNet Node Swap
Easy to use
No special code
Automatic Crossloading of data
and logic
Treat as one chassis
Uses Standard 1756 hardware
Up To:
2 Controllers
7 Communications Modules
ControlLogix® Redundancy
4. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 4
PUBLIC
Introduction ControlLogix Redundancy
ControlLogix Redundancy consist of:
2 separate ControlLogix chassis with identical hardware and firmware
configuration
Standard ControlLogix hardware is used
Each chassis contains a redundancy module
Redundancy modules are connected by a fiber link
Redundant fiber links with the 1756-RM2
Redundancy switches system control from one chassis to the other
Chassis can only contain processor(s) and communications modules
No I/O can reside in the redundancy chassis
All I/O is remote I/O
ControlLogix Redundancy uses standard ControlLogix hardware
with the addition of the redundancy modules
5. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 5
PUBLIC
Introduction to ControlLogix Redundancy
Operation Basics
Application in Primary is automatically
crossloaded into the Secondary processor
Data changes are sent to secondary at the end
of each program
On-Line application changes are also sent from
the primary to the secondary
This keeps Primary and Secondary always
synchronized
System is “Floating Master” type. Each chassis
is capable of being Primary
5
Secondary Chassis
Primary Chassis
1756-RM2
6. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 6
PUBLIC
Introduction to ControlLogix Redundancy
Example ControlLogix Redundancy configuration with
ControlNet remote I/O
7. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 7
PUBLIC
Introduction to ControlLogix Redundancy
All I/O in a redundancy system is remote I/O
The switchover between chassis is bumpless for all class1 connections
I/O
Producer/Consumer tags (Ethernet)
Connections that are Class 1 are not dropped during the switchover
The chassis currently controlling the process is the Primary chassis
The other chassis is the Secondary Chassis
Chassis are also labeled as: Chassis A and Chassis B. These label
the physical chassis. These names to not change on switchover
Redundancy provides a bumpless switchover to a second
ControlLogix chassis.
ControlLogix Redundancy switchovers are bumpless
8. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 8
PUBLIC
Introduction to ControlLogix Redundancy
The redundancy module monitors the primary chassis for module faults.
A module faults triggers a switchover to the other chassis
A switchover moves system control from one chassis to the other
All communications is switchover over at the same time
Control of all I/O is moved to the new Primary chassis
HMI communication is moved to the new Primary chassis
The new Primary continues running the application at the end of last
synchronization point.
The application continues to run in the New Primary chassis where it left off
A redundancy switchover moves system control to the secondary
ControlLogix chassis.
A switchover moves system control from one chassis to the
other.
9. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 9
PUBLIC
Introduction to ControlLogix Redundancy
The Redundancy Module synchronizes the 2 redundancy chassis
The application code is automatically crossloaded from the Primary controller to the
Secondary controller
All on-line changes are crossloaded while the process is running
We do not download an application to the secondary controller, it is
crossloaded by the redundancy module.
Tag values are automatically crossloaded from the Primary controller to the
Secondary controller while the program is running
We do not need to configure crossloading
During a switchover, the new primary is ready to run the process with the
crossloaded data.
The Redundancy module synchronizes the chassis
10. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 10
PUBLIC
Introduction to ControlLogix Redundancy
Address swapping keeps the Primary chassis at the same IP Address and
Node number
The secondary always has an IP Address and Node number of 1 +
the primaries address
This always points the HMI, programming terminal and all other
devices at the primary chassis
We do not need to communicate to the secondary chassis
You should not communicate to the secondary chassis
Must account for the extra IP Address and Node number in your network
design.
You will see the secondary's modules in RSLinx
Address swapping keeps the Primary chassis always at the
same IP address and node number
11. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 11
PUBLIC
Introduction to ControlLogix Redundancy
The entire ControlLogix chassis is duplicate by another chassis
This keeps the process running during system faults:
Chassis power supply faults
Redundant power supplies are supported.
Communications Module fault – hardware or firmware
This gives us redundant communications modules
DLR is supported
Controller fault – hardware, firmware or application code major fault
Major faults include: Array index out of range, watchdog
No single point of failure can take the system down
ControlLogix Redundancy is design for High Availability
No single point of failure can take a ControlLogix Redundancy
system down
12. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 12
PUBLIC
Introduction to ControlLogix Redundancy
Upgrades can be made while the process is running
A locked update switchover allows ControlLogix Redundancy to switchover to a
chassis with upgraded firmware and/or hardware.
Hardware can be changed and upgraded while the system is running
Firmware updates can be made while the system is running
Primary and Secondary controllers are always automatically synchronized
No data is lost during a switchover
I/O stays connected during a switchover (bumpless switchover)
ControlLogix Redundancy is design for High Availability
Firmware and hardware upgrades can be made while the
process is running.
13. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 13
PUBLIC
Agenda
Monitoring Redundancy
Redundancy Switchover
How to Enable and Configure
Hardware and Restrictions
Introduction to Redundancy
14. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 14
PUBLIC
Hardware and Restrictions
The firmware bundle contains:
All of the firmware for the all of the modules that can be used in the
redundancy chassis
Release Notes for the firmware bundle
List of supported modules
Firmware version included in the bundle for all supported modules
List of corrected anomalies, known anomalies, restrictions
Detailed system upgrade instructions
A new version of the Redundancy Module Configuration Tool (RMCT)
ControlLogix Redundancy is released with a firmware bundle
Redundancy requires all modules in the redundancy chassis to
use the redundancy firmware bundle
15. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 15
PUBLIC
Hardware and Restrictions
Latest firmware bundle release is V30.051
For this presentation we are only discussing the latest hardware and
firmware for ControlLogix Redundancy
1756-RM2 Module
1756-RM and 1757-SRM modules are no longer being sold
1756-RM2 is the only supported Redundancy Module in V24.05x and beyond.
1756-EN2T / 1756-EN2TR / 1756-EN2F
Supported Ethernet modules in the redundancy chassis
1756-CN2 / 1756-CN2R
Supported ControlNet modules in the redundancy chassis
1756-L7x Controllers
1756-L6x controllers are still supported, but you get much more performance with
the 1756-L7x. And Double Data Rate on the backplane (DDR)
1756-L7x is the only supported controller type in V24.05x and beyond
16. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 16
PUBLIC
Hardware and Restrictions
Ethernet I/O connections must be Multicast
This also means all Ethernet I/O must be on the same subnet
Produced tags can be Unicast or Multicast
Consumed tags must be Multicast
Event tasks are not supported
Motion control is not supported
All tasks must be enabled
Scan time will increase approximately 15%-35% while redundancy is synchronized
Scan time will decrease when redundancy is not synchronized
Task Watchdog time will need to be set according to guidelines found in the users manual
In most cases the watchdog time will need to be increased over what is normally used
The designer of a ControlLogix Redundancy system will need to
review the system restrictions before designing the system
ControlLogix Redundancy has a few key restriction from a non-
redundant system
17. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 17
PUBLIC
Agenda
Monitoring Redundancy
Redundancy Switchover
How to Enable and Configure
Hardware and Restrictions
Introduction to Redundancy
18. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 18
PUBLIC
How to Enable and Configure
Configuration of ControlLogix
Redundancy requires checking
a checkbox in the controller
properties of the application
code.
That is the only
configuration required in
the application code!
The checkbox enables
redundancy
ControlLogix Redundancy requires only a checkbox to turn the
redundancy functionality On
19. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 19
PUBLIC
How to Enable and Configure
ControlLogix Redundancy Configuration Check List:
Review the Redundancy Bundle release notes:
Review known limitations and restrictions
Corrected anomalies, Known anomalies
Install the firmware bundle on all modules in both redundancy chassis
Install the Redundancy Module Configuration Tool (RMCT) on the
engineering workstation
Configure on chassis as A and the other as B
Set the time on the 1756-RM2 clock
Check the Enable Redundancy checkbox in the application
Download the application to the Primary Chassis Controller
Redundancy firmware bundle release notes should be reviewed
before installing or upgrading a system.
20. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 20
PUBLIC
Agenda
Monitoring Redundancy
Redundancy Switchover
How to Enable and Configure
Hardware and Restrictions
Introduction to Redundancy
21. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 21
PUBLIC
Redundancy Switchover
Current Redundancy state can be monitored on the 1756-RM2 LED
display
PRIM – Primary chassis, controlling the process
SYNC – Secondary chassis, synchronized
DISQ – Secondary chassis, not synchronized
QFNG – Secondary chassis, in the process of synchronizing
The RM2 LED display will let you quickly find the Primary redundancy
chassis.
The RM2 LED display gives you the current redundancy status
22. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 22
PUBLIC
Redundancy Switchover
Primary Chassis
Both fiber channels OK
Active fiber channel LED will blink
RM2 Module OK
Synchronized Secondary
Both fiber channels OK
Active fiber channel LED will blink
RM2 Module OK
Primary Chassis
Both fiber channels faulted
Secondary maybe be powered off
RM2 Module OK
23. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 23
PUBLIC
Redundancy Switchover
ControlLogix Redundancy Modes:
You can monitor which mode is active from the RMCT and inside of the application logic using a
GSV instruction pointed to the redundancy module object
These are the names of the statuses used in the RMCT and the GSV
Statuses in the Primary 1756-RM2:
Primary with Qualified Secondary (PwQS)
System is synchronized and secondary is ready to take over control as needed
Primary with Disqualified Secondary (PwDS)
Primary is controlling the system. The secondary has a fault or is in the process of qualification
Primary with No Secondary (PwNS)
Primary is controlling the system. The primary cannot see the secondary from the fiber link between
the redundancy modules. Secondary may have lost power
Statuses in the Secondary 1756-RM2:
Qualified Secondary (QS)
Secondary is synchronized and ready to take over control as needed
Disqualified Secondary with Primary (DQSwP)
Secondary has not yet synchronized or has a fault present that is preventing synchronization
Disqualified Secondary with No Primary (DQSwN)
The secondary cannot see the primary from the fiber link between the redundancy modules
24. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 24
PUBLIC
Redundancy Switchover
ControlLogix Redundancy switchovers occur due to:
Power Loss in Primary chassis
Module fault in Primary chassis
Controller fault in Primary chassis
Chassis backplane failure
Complete loss of communications on a communication module in the
Primary chassis
Ethernet Link Loss
ControlNet goes Lonely
Manual switchover, from:
Controller
HMI
Redundancy Module Configuration Tool (RMCT) in RSLinx Classis
Faults and loss of power trigger a redundancy switchover
25. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 25
PUBLIC
Redundancy Switchover
ControlLogix Redundancy does not switchover due to:
Remote I/O fault
Loss of communication to any remote I/O chassis or module
Module fault in a remote I/O connection
Communications fault
Communications must be a lost completely at the module to trigger a switchover.
Such as a broken wire or power off at the switch
Loss of connection to Secondary Chassis
Secondary chassis will Disqualify, but no switchover
Fault in secondary will Disqualify, but no switchover
Controller going into Program Mode
Downloading a new application to the controller
Faults and loss of power at the primary redundancy chassis
trigger a redundancy switchover
26. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 26
PUBLIC
Agenda
Monitoring Redundancy
Redundancy Switchover
How to Enable and Configure
Hardware and Restrictions
Introduction to Redundancy
27. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 27
PUBLIC
Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Opening the RMCT from RSLinx Classic. The redundancy module was
selected and then a right click to Module Configuration
Right mouse
Click here
Select
Module Configuration
28. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 28
PUBLIC
Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Opening tab of the RMCT
29. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 29
PUBLIC
Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Configuration – Turn off Synchronization, define chassis ID, update
redundancy module log time and date (not sync’d with Logix)
30. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 30
PUBLIC
Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Synchronization – history of recent synchronization attempts. Ability to
manually synchronize, disqualify, and switchover
31. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 31
PUBLIC
Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Synchronization Status, Displays active % complete while the system
is synchronizing
32. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 32
PUBLIC
Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Event Log – Advanced redundancy debug logging information. You
may need to export this and send to tech support if you a question on
a switchover or fault
33. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 33
PUBLIC
Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
System Update – used for the Locked update procedure to update
firmware and hardware on a running redundancy system
34. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 34
PUBLIC
Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
System Event History – Brief history of redundancy events. Designed to be a readable
event history. Much easier to read then the event log. The Data and Time are from the
redundancy module clock, not the controllers clock
35. Copyright © 2018 Rockwell Automation, Inc. All Rights Reserved. 35
PUBLIC
Important Knowledgebase Articles
457489 - Logix Redundancy Book of Knowledge
55721 - Extracting Log Files from 1756-RM2, 1756-RM or 1757-SRM
64856 - Required information when escalating a case to Commercial Engineering
24140 - Reasons for a CLX redundancy switchover
106085 - How to Programmatically Initiate a Switchover with ControlLogix Redundancy
518071 - Application update required displayed on 1756-RM2
117001 - Control Logix Redundancy 1756-RM2/RM and 1757-SRM fiber cable distances and specs
484206 - CIP SYNC restrictions when used with redundancy systems
578295 - Upgrading a Running ControlLogix Redundancy system to 1756-EN2T/D or 1756-EN2TR/C
26789 - GSV REDUNDANCY Object
61633 - Can a ControlLogix Redundancy type 12 code 32 fault be cleared without going online using RSLogix 5000
24419 - Type 12 Redundancy Fault and Code 32 Disqualified Secondary Became Primary
57158 - How programmatically set SRM Time in Redundancy System Version 16 or higher
63409 - Using the Redundancy System Update (RSU) feature to re download the application
68509 - FactoryTalk Alarm and Events (FTAE) - Enhanced ControlLogix Redundancy
576781 - Logix Redundancy Upgrading Ethernet Modules With Rotary Switches
565372 - How to update modules in an enhanced redundant system
457490 Red Supports Unicast Produced Tags
449304 - Logix Redundancy User Selectable Switchover on Ethernet Network Loss
119660 - Logix Redundancy RM/SRM Log Error - Partner Not on Same Link
Editor's Notes IAB View of Redundancy Exceptions: Not all ControlNet P/C is bumpless. May Not be bumpless to I/O network scanners in remote chassis. DeviceNet, third party modbus, etc. Communications faults or I/O do not trigger a switchover – More on switchover conditions in an upcoming slide.
Communications faults or I/O do not trigger a switchover
Communications faults or I/O do not trigger a switchover
Communications faults or I/O do not trigger a switchover!
Application changes that cannot be made on-line with a standard Logix system cannot be made on-line with redundancy. Even with the locked switchover! For a locked switchover the application files must be identical with only a firmware update.
Communications faults or I/O do not trigger a switchover!
Application changes that cannot be made on-line with a standard Logix system cannot be made on-line with redundancy. Even with the locked switchover! For a locked switchover the application files must be identical with only a firmware update.
Modules in remote chassis are not required to use firmware from the bundle. Scan can increase to 50% if the program is not well optimized for redundancy. Communications faults or I/O do not trigger a switchover
Key Points: RM2 display helping you find the Primary chassis Active fiber channel LED will blink, faulted fiber channel is Red. OK Fiber Channel is Green.
Communications faults or I/O do not trigger a switchover
Communications faults or I/O do not trigger a switchover
Communications faults or I/O faults do not trigger a switchover. The system does not monitor which chassis has better access to the remote I/O and switchover to use the better of the two as the primary.
Describe how to navigate to the RMCT. If the module configuration selecting is not listed the RMCT is not installed. Key Points: Module Product information, Redundancy Major Fault code, Only place to monitor fiber channel switchovers. Key Points: Synchronization is turned off by setting auto-sync to never. Used for Locked firmware update and when you do not want the secondary to become primary
Chassis ID is the physical chassis ID. It does not change after a switchover. It is useful to identify which chassis is A and B to correlate this to the logs when troubleshooting.
Redundancy modules have an internal time and date. This is not automatically sync’d with the Logix time and date. It can be sync’d using application logic in the controller. Key Points: User buttons to synchronize, disqualify and switchover. Recent Sync History is brief, but filters out other log records. Key Points: Sync % Complete – great way to monitor synchronization if it is taking a long time due to a large application. Compatibility can quickly show you which module are not compatible to quickly debug a system that will not sync. Key Points: Save this for RA Tech support and engineering. Most of the logs are not a concern. Many minor faults are logged that do not impact a running system. They are only logged as debug information to support major faults. Key Points: Tab used to lock the system for a firmware and/or hardware update on a running system. Key Points: Great place to go for a history of what has happened with the redundancy system. If you had a switchover in the middle of this night, this is the place to go to see why it happened. It can also help you find out why the secondary is not qualifying – most likely that was the reason for the switchover. With Hyperlinks