1. Welcome! Thank you for joining us. We’ll get started in a few minutes.
You must join the teleconference to hear the audio portion of the broadcast. You cannot listen through your computer. Dial:
You will hear hold music until the broadcast begins. This is expected 
We will send the presentation and a recording of today’s broadcast to you within a few days after the session.

2. February 2014 TechConnect Genius Webinar
ControlLogix Redundancy
Jason Lakomiak
Application Engineer
February, 2014

3. Agenda Introduction to Redundancy Hardware and Restrictions
How to Enable and Configure
Redundancy Switchover
Monitoring Redundancy

4. Introduction to Redundancy
ControlLogix®® Redundancy
Dual Chassis Design
Full Redundancy
Both Chassis match
Transparent
Primary/Secondary Chassis
IP Address Swap
ControlNet Node Swap
Easy to use
No special code
Automatic Crossloading of data and logic
Treat as one chassis
Uses Standard 1756 hardware
IAB View of Redundancy
Up To:
2 Controllers
7 Communications Modules

5. Introduction to Redundancy
ControlLogix Redundancy consist of:
2 separate ControlLogix chassis with identical hardware and firmware configuration
Standard ControlLogix hardware is used
Each chassis contains a redundancy module
Redundancy modules are connected by a fiber link
Redundant fiber links with the 1756-RM2
Redundancy switches system control from one chassis to the other
Chassis can only contain processor(s) and communications modules.
No I/O can reside in the redundancy chassis
All I/O is remote I/O
ControlLogix Redundancy uses standard ControlLogix hardware with the addition of the redundancy modules.

6. Introduction to Redundancy
Operation Basics
Application in Primary is automatically crossloaded into the Secondary processor
Data changes are sent to secondary at the end of each program.
On-Line application changes are also sent from the primary to the secondary.
This keeps Primary and Secondary always syncronized
System is “Floating Master” type. Each chassis is capable of being Primary
Primary Chassis
1756-RM2
Secondary Chassis

7. Introduction to Redundancy
Example ControlLogix Redundancy configuration with ControlNet remote I/O.

8. Introduction to Redundancy
Redundancy provides a bumpless switchover to a second ControlLogix chassis.
All I/O in a redundancy system is remote I/O
The switchover between chassis is bumpless for all class1 connections
I/O
Producer/Consumer tags (Ethernet)
Connections that are Class 1 are not dropped during the switchover
The chassis currently controlling the process is the Primary chassis
The other chassis is the Secondary Chassis
Chassis are also labeled as: Chassis A and Chassis B. These label the physical chassis. These names to not change on switchover.
Exceptions: Not all ControlNet P/C is bumpless. May Not be bumpless to I/O network scanners in remote chassis. DeviceNet, third party modbus, etc.
ControlLogix Redundancy switchovers are bumpless

9. Introduction to Redundancy
A redundancy switchover moves system control to the secondary ControlLogix chassis.
The redundancy module monitors the primary chassis for module faults.
A module faults triggers a switchover to the other chassis
A switchover moves system control from one chassis to the other
All communications is switchover over at the same time
Control of all I/O is moved to the new Primary chassis
HMI communication is moved to the new Primary chassis
The new Primary continues running the application at the end of last synchronization point.
The application continues to run in the New Primary chassis where it left off
Communications faults or I/O do not trigger a switchover – More on switchover conditions in an upcoming slide.
A switchover moves system control from one chassis to the other.

10. Introduction to Redundancy
The Redundancy Module synchronizes the 2 redundancy chassis
The application code is automatically crossloaded from the Primary controller to the Secondary controller
All on-line changes are crossloaded while the process is running
We do not download an application to the secondary controller, it is crossloaded by the redundancy module.
Tag values are automatically crossloaded from the Primary controller to the Secondary controller while the program is running
We do not need to configure crossloading
During a switchover, the new primary is ready to run the process with the crossloaded data.
Communications faults or I/O do not trigger a switchover
The Redundancy module synchronizes the chassis

11. Introduction to Redundancy
Address swapping keeps the Primary chassis at the same IP Address and Node number
The secondary always has an IP Address and Node number of 1 + the primaries address
This always points the HMI, programming terminal and all other devices at the primary chassis
We do not need to communicate to the secondary chassis
You should not communicate to the secondary chassis
Just be account for the extra IP Address and Node number in your network design.
You will see the secondary's modules in RSLinx
Communications faults or I/O do not trigger a switchover
Address swapping keeps the Primary chassis always at the same IP address and node number

12. Introduction to Redundancy
ControlLogix Redundancy is design for High Availability
The entire ControlLogix chassis is duplicate by another chassis
This keeps the process running during system faults:
Chassis power supply faults
Redundant power supplies are supported.
Communications Module fault – hardware or firmware
This gives us redundant communications modules
DLR is supported
Controller fault – hardware, firmware or application code major fault
Major faults include: Array index out of range, watchdog
No single point of failure can take the system down
Communications faults or I/O do not trigger a switchover!
Application changes that cannot be made on-line with a standard Logix system cannot be made on-line with redundancy. Even with the locked switchover! For a locked switchover the application files must be identical with only a firmware update.
No single point of failure can take a ControlLogix Redundancy system down

13. Introduction to Redundancy
ControlLogix Redundancy is design for High Availability
Upgrades can be made while the process is running
A locked update switchover allows ControlLogix Redundancy to switchover to a chassis with upgraded firmware and/or hardware.
Hardware can be changed and upgraded while the system is running
Firmware updates can be made while the system is running
Primary and Secondary controllers are always automatically synchronized
No data is lost during a switchover
I/O stays connected during a switchover (bumpless switchover)
Communications faults or I/O do not trigger a switchover!
Application changes that cannot be made on-line with a standard Logix system cannot be made on-line with redundancy. Even with the locked switchover! For a locked switchover the application files must be identical with only a firmware update.
Firmware and hardware upgrades can be made while the process is running.

14. Agenda Introduction to Redundancy Hardware and Restrictions
How to Enable and Configure
Redundancy Switchover
Monitoring Redundancy

15. Hardware and Restrictions
ControlLogix Redundancy is released with a firmware bundle
The firmware bundle contains:
All of the firmware for the all of the modules that can be used in the redundancy chassis
Release Notes for the firmware bundle
List if supported modules
Firmware version included in the bundle for all supported modules
List of: corrected anomalies, known anomalies, restrictions
Detailed system upgrade instructions
A new version of the Redundancy Module Configuration Tool (RMCT)
Modules in remote chassis are not required to use firmware from the bundle.
Redundancy requires all modules in the redundancy chassis to use the redundancy firmware bundle

16. Hardware and Restrictions
For this presentation we are only discussing the latest hardware and firmware for ControlLogix Redundancy
1756-RM2 Module
1756-RM and 1757-SRM modules are no longer being sold
1756-EN2T / 1756-EN2TR / 1756-EN2F
Supported Ethernet modules in the redundancy chassis
1756-CN2 / 1756-CN2R
Supported ControlNet modules in the redundancy chassis
1756-L7x Controllers
1756-L6x controllers are still supported, but you get much more performance with the 1756-L7x. And Double Data Rate on the backplane. (DDR)
Latest firmware bundle release is V20.055

17. Hardware and Restrictions
V Is the Latest Release
All of the features of RSLogix 5000 v20!
Automatic Device Configuration
Updated device AOPs
Last release for L6x processors and Windows XP
SIL 2 Rating
This firmware bundle is SIL 2 rated. (v is not)
1756-EN2F support
HMI Improved Recovery Time
The amount of time that the HMI tags are not updating after a Logix Redundancy switchover has been greatly reduced! Typically 3-6 seconds, 10 seconds maximum.
Reduced from seconds.
RSLinx Enterprise Only (and FactoryTalk OPC Gateway)

18. Hardware and Restrictions
ControlLogix Redundancy has a few key restriction from a non-redundant system.
Ethernet I/O connections must be Multicast
This also means all Ethernet I/O must be on the same subnet
Produced tags can be Unicast or Multicast
Consumed tags must be Multicast
Event tasks are not supported
Motion control is not supported
All tasks must be enabled
Scan time will increase approximately 15%-35% while redundancy is synchronized.
Scan time will decrease when redundancy is not synchronized.
Task Watchdog time will need to be set according to guidelines found in the users manual
In most cases the watchdog time will need to be increased over what is normally used.
The designer of a ControlLogix Redundancy system will need to review the system restrictions before designing the system.

19. Agenda Introduction to Redundancy Hardware and Restrictions
How to Enable and Configure
Redundancy Switchover
Monitoring Redundancy

20. How to Enable and Configure
Configuration of ControlLogix Redundancy requires checking a checkbox in the controller properties of the application code.
That is the only configuration required in the application code!
The checkbox enables redundancy
Communications faults or I/O do not trigger a switchover
ControlLogix Redundancy requires only a checkbox to turn the redundancy functionality On

21. How to Enable and Configure
ControlLogix Redundancy Configuration Check List:
Review the Redundancy Bundle release notes:
Review known limitations and restrictions
Corrected anomalies, Known anomalies
Install the firmware bundle on all modules in both redundancy chassis
Install the Redundancy Module Configuration Tool (RMCT) on the engineering workstation.
Configure on chassis as A and the other as B
Set the time on the 1756-RM2 clock
Check the Enable Redundancy checkbox in the application
Download the application to the Primary Chassis Controller
Redundancy firmware bundle release notes should be reviewed before installing or upgrading a system.

22. Agenda Introduction to Redundancy Hardware and Restrictions
How to Enable and Configure
Redundancy Switchover
Monitoring Redundancy

23. Redundancy Switchover
Current Redundancy state can be monitored on the 1756-RM2 LED display
PRIM – Primary chassis, controlling the process
SYNC – Secondary chassis, synchronized
DISQ – Secondary chassis, not synchronized
QFNG – Secondary chassis, in the process of synchronizing
The RM2 LED display will let you quickly find the Primary redundancy chassis.
Key Points: RM2 display helping you find the Primary chassis
The RM2 LED display gives you the current redundancy status.

24. Redundancy Switchover
Primary Chassis
Both fiber channels OK
Active fiber channel LED will blink
RM2 Module OK
Synchronized Secondary
Both fiber channels faulted
Secondary maybe be powered off
Communications faults or I/O faults do not trigger a switchover. The system does not monitor which chassis has better access to the remote I/O and switchover to use the better of the two as the primary.

25. Redundancy Switchover
ControlLogix Redundancy Modes:
You can monitor which mode is active from the RMCT and inside of the application logic using a GSV instruction pointed to the redundancy module object.
These are the names of the statuses used in the RMCT and the GSV
Statuses in the Primary 1756-RM2:
Primary with Qualified Secondary (PwQS)
System is synchronized and secondary is ready to take over control as needed
Primary with Disqualified Secondary (PwDS)
Primary is controlling the system. The secondary has a fault or is in the process of qualification.
Primary with No Secondary (PwNS)
Primary is controlling the system. The primary cannot see the secondary from the fiber link between the redundancy modules. Secondary may have lost power.
Statuses in the Secondary 1756-RM2:
Qualified Secondary (QS)
Secondary is synchronized and ready to take over control as needed.
Disqualified Secondary with Primary (DQSwP)
Secondary has not yet synchronized or has a fault present that is preventing synchronization
Disqualified Secondary with No Primary (DQSwN)
The secondary cannot see the primary from the fiber link between the redundancy modules.
Communications faults or I/O do not trigger a switchover

26. Redundancy Switchover
ControlLogix Redundancy switchovers occur due to:
Power Loss in Primary chassis
Module fault in Primary chassis
Controller fault in Primary chassis
Chassis backplane failure
Complete loss of communications on a communication module in the Primary chassis
Ethernet Link Loss
ControlNet goes Lonely
Manual switchover, from:
Controller
HMI
Redundancy Module Configuration Tool (RMCT) in RSLinx Classis
Communications faults or I/O do not trigger a switchover
Faults and loss of power trigger a redundancy switchover

27. Redundancy Switchover
ControlLogix Redundancy does not switchover due to:
Remote I/O fault
Loss of communication to any remote I/O chassis or module.
Module fault in a remote I/O connection
Communications fault
Communications must be a lost completely at the module to trigger a switchover. Such as a broken wire or power off at the switch.
Loss of connection to Secondary Chassis
Secondary chassis will Disqualify, but no switchover
Fault in secondary will Disqualify, but no switchover
Controller going into Program Mode
Downloading a new application to the controller
Communications faults or I/O faults do not trigger a switchover. The system does not monitor which chassis has better access to the remote I/O and switchover to use the better of the two as the primary.
Faults and loss of power at the primary redundancy chassis trigger a redundancy switchover.

28. Agenda Introduction to Redundancy Hardware and Restrictions
How to Enable and Configure
Redundancy Switchover
Monitoring Redundancy

29. Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Opening the RMCT from RSLinx Classic. The redundancy module was selected and then a right click to Module Configuration.
Right mouse Click here
Describe how to navigate to the RMCT. If the module configuration selecting is not listed the RMCT is not installed.
Select
Module Configuration

30. Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Opening tab of the RMCT
Key Points: Module Product information, Redundancy Major Fault code, Only place to monitor fiber channel switchovers.

31. Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Configuration – Turn off Synchronization, define chassis ID, update redundancy module log time and date. (not sync’d with Logix)
Key Points: Synchronization is turned off by setting auto-sync to never. Used for Locked firmware update and when you do not want the secondary to become primary
Chassis ID is the physical chassis ID. It does not change after a switchover. It is usefull to identy which chassis is A and B to correlate this to the logs when troubleshooting.
Redundancy modules have an internal time and date. This is not automaticly sync’d with the Logix time and date. It can be sync’d using application logic in the controler.

32. Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Synchronization – history of recent synchronization attempts. Ability to manually synchronize, disqualify, and switchover
Key Points: User buttons to syncronize, disqualify and switchover. Recent Sync History is brief, but filters out other log records.

33. Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Synchronization Status, Displays active % complete while the system is synchronizing.
Key Points: Sync % Complete – great way to monitor synchronization if it is taking a long time due to a large application. Compatibility can quickly show you which module are not compatible to quickly debug a system that will not sync.

34. Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
Event Log – Advanced redundancy debug logging information. You may need to export this and send to tech support if you a question on a switchover or fault.
Key Points: Save this for RA Tech support and engineering. Most of the logs are not a concern. Many minor faults are logged that do not impact a running system. They are only logged as debug information to support major faults.

35. Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
System Update – used for the Locked update procedure to update firmware and hardware on a running redundancy system.
Key Points: Tab used to lock the system for a firmware and/or hardware update on a running system.

36. Monitoring Redundancy
Monitoring Redundancy Status with the RMCT
System Event History – Brief history of redundancy events. Designed to be a readable event history. Much easier to read then the event log. The Data and Time are from the redundancy module clock, not the controllers clock.
Key Points: Great place to go for a history of what has happened with the redundancy system. If you had a switchover in the middle of this night, this is the place to go to see why it happened. It can also help you find out why the secondary is not qualifying – most likely that was the reason for the switchover.

37. Important Knowledgebase Articles
Logix Redundancy Book of Knowledge
Extracting Log Files from 1756-RM2, 1756-RM or 1757-SRM
Required information when escalating a case to Commercial Engineering
Reasons for a CLX redundancy switchover
106085 - How to Programmatically Initiate a Switchover with ControlLogix Redundancy
518071 - Application update required displayed on 1756-RM2
Control Logix Redundancy 1756-RM2/RM and 1757-SRM fiber cable distances and specs
CIP SYNC restrictions when used with redundancy systems
How to update modules in an enhanced redundant system
Upgrading a Running ControlLogix Redundancy system to 1756-EN2T/D or 1756-EN2TR/C
GSV REDUNDANCY Object
Can a ControlLogix Redundancy type 12 code 32 fault be cleared without going online using RSLogix 5000
Type 12 Redundancy Fault and Code 32 Disqualified Secondary Became Primary
How programmatically set SRM Time in Redundancy System Version 16 or higher
Using the Redundancy System Update (RSU) feature to re download the application
FactoryTalk Alarm and Events (FTAE) - Enhanced ControlLogix Redundancy
Logix Redundancy Upgrading Ethernet Modules With Rotary Switches
Red Supports Unicast Produced Tags
Logix Redundancy User Selectable Switchover on Ethernet Network Loss
Logix Redundancy RM/SRM Log Error - Partner Not on Same Link
With Hyperlinks

38. Questions?

39. Thank You For Attending!