ControlLogix
Redundancy
System
Catalog Numbers 1756-CNB/D/E,
1756-CNBR/D/E, 1756-ENBT,
1756-EWEB, 1756-L55,
1756-L55M12, 1756-L55M13,
1756-L55M14, 1756-L55M16,
1756-L55M22, 1756-L55M23,
1756-L55M24, 1756-L61, 1756-L62,
1756-L63, 1757-SRM
User Manual
Important User Information
Solid state equipment has operational characteristics differing from those of
electromechanical equipment. Safety Guidelines for the Application,
Installation and Maintenance of Solid State Controls (publication SGI-1.1
available from your local Rockwell Automation sales office or online at
http://literature.rockwellautomation.com
) describes some important
differences between solid state equipment and hard-wired electromechanical
devices. Because of this difference, and also because of the wide variety of
uses for solid state equipment, all persons responsible for applying this
equipment must satisfy themselves that each intended application of this
equipment is acceptable.
In no event will Rockwell Automation, Inc. be responsible or liable for
indirect or consequential damages resulting from the use or application of
this equipment.
The examples and diagrams in this manual are included solely for illustrative
purposes. Because of the many variables and requirements associated with
any particular installation, Rockwell Automation, Inc. cannot assume
responsibility or liability for actual use based on the examples and diagrams.
No patent liability is assumed by Rockwell Automation, Inc. with respect to
use of information, circuits, equipment, or software described in this manual.
Reproduction of the contents of this manual, in whole or in part, without
written permission of Rockwell Automation, Inc., is prohibited.
Throughout this manual, when necessary, we use notes to make you aware
of safety considerations.
Allen-Bradley, RSLogix, RSLogix 5000, RSView, RSLinxRSNetworx, DH+, PanelView, PanelViewPlus, Rockwell Automation,
TechConnect, and VersaView are trademarks of Rockwell Automation, Inc.
Trademarks not belonging to Rockwell Automation are property of their respective companies.
WARNING
Identifies information about practices or circumstances that can cause
an explosion in a hazardous environment, which may lead to personal
injury or death, property damage, or economic loss.
IMPORTANT
Identifies information that is critical for successful application and
understanding of the product.
ATTENTION
Identifies information about practices or circumstances that can lead
to: personal injury or death, property damage, or economic loss.
Attentions help you identify a hazard, avoid a hazard, and recognize
the consequence
SHOCK HAZARD
Labels may be on or inside the equipment, for example, a drive or
motor, to alert people that dangerous voltage may be present.
BURN HAZARD
Labels may be on or inside the equipment, for example, a drive or
motor, to alert people that surfaces may reach dangerous
temperatures.
3 Publication 1756-UM523F-EN-P - December 2006
Summary of Changes
Introduction
This release of this document contains new and updated information.
To find new and updated information, look for change bars, as shown
next to this paragraph.
Updated Information
The document contains these changes.
Topic Page
Series E information for 1756-CNB and -CNBR modules Throughout manual
Redundant System Firmware Combinations 14
Revised Procedure for Setting the Minimum Value for the Watchdog Time 100
Restrictions and Known Anomalies Appendix E
Update an Online Redundant System 138
Store a Project to Nonvolatile Memory While Process Is Running 128
Change CNB Modules from Series D to Series E While Online 129
Publication 1756-UM523F-EN-P - December 2006
Summary of Changes 4
Notes:
5 Publication 1756-UM523F-EN-P - December 2006
Table of Contents
Preface
Purpose of this Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Who Should Use this Manual. . . . . . . . . . . . . . . . . . . . . . . . 11
When to Use This Manual . . . . . . . . . . . . . . . . . . . . . . . . . . 11
How to Use this Manual . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Related Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Chapter 1
ControlLogix Redundancy System
Overview
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
About the Main Parts of a Redundant System . . . . . . . . . . . . 14
Firmware Combinations That Make Up a Redundant System . 14
Important Terms in a Redundant System . . . . . . . . . . . . . . . 15
Primary Chassis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Switching from One Controller to Another . . . . . . . . . . . . . . 15
Network Access Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Bump in Outputs During a Switchover. . . . . . . . . . . . . . . . . 16
Keep the Second Controller Up to Date . . . . . . . . . . . . . . . . 16
Making Online Edits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Increasing Scan Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Network Addresses During a Switchover . . . . . . . . . . . . . . . 18
ControlNet Network. . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
EtherNet/IP Network . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Quick Start Checklists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Chapter 2
Design the System
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Laying Out the System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Placement of a Pair of Redundant Chassis . . . . . . . . . . . . . . 30
If You Need More Than 100 Meters Between Chassis . . . 30
Placement of the I/O. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Placement of Operator Interface Terminals. . . . . . . . . . . . . . 32
Additional Redundant Components . . . . . . . . . . . . . . . . . . . 33
Redundant ControlNet Media . . . . . . . . . . . . . . . . . . . . . 33
Redundant Power Supplies. . . . . . . . . . . . . . . . . . . . . . . 34
Checking Connection Requirements. . . . . . . . . . . . . . . . . . . 35
Planning a ControlNet Network . . . . . . . . . . . . . . . . . . . . . . 35
Planning an EtherNet/IP Network . . . . . . . . . . . . . . . . . . . . 38
Worksheet for IP Swapping . . . . . . . . . . . . . . . . . . . . . . 39
How an EtherNet/IP Module Handles a Cable Break . . . . 40
Additional Design Considerations . . . . . . . . . . . . . . . . . . . . 41
Chapter 3
Install the System
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Preliminary Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Install the Chassis for the Controllers . . . . . . . . . . . . . . . . . . 45
Install Modules in the First Redundant Chassis . . . . . . . . . . . 46
Install Modules in the Second Redundant Chassis . . . . . . . . . 48
Publication 1756-UM523F-EN-P - December 2006
6 Table of Contents
Install the Remote Chassis or Rails . . . . . . . . . . . . . . . . . . . . 49
Configure EtherNet/IP Modules . . . . . . . . . . . . . . . . . . . . . . 50
Flash the Modules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Check the Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Chapter 4
Configure the System Redundancy
Module
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Open the SRM Configuration Tool . . . . . . . . . . . . . . . . . . . . 53
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
What to Do Next . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Check the Revision of Your SRM Configuration Tool . . . . . . 55
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Set the SRM Clock. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Test a Switchover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Change Auto-Synchronization . . . . . . . . . . . . . . . . . . . . . . . 61
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Change Program Control . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Chapter 5
Configure and Program the
Controller
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Plan for Online Edits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Decide if You Want to Keep Test Edits
after a Switchover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Be Aware That Finalizing Edits Removes Your
Original Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Decide How You Want to Set Aside Unused Memory . . . 67
Configure a Controller for Redundancy . . . . . . . . . . . . . . . . 68
Configure Communications . . . . . . . . . . . . . . . . . . . . . . . . . 70
Configure Produced Tags . . . . . . . . . . . . . . . . . . . . . . . 70
Configure Message (MSG) Instructions . . . . . . . . . . . . . . 72
Configure Tags for an HMI. . . . . . . . . . . . . . . . . . . . . . . 73
Estimate the Crossload Time of a Program . . . . . . . . . . . . . . 74
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Minimize Scan Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Publication 1756-UM523F-EN-P - December 2006
Table of Contents 7
Maintain Data Integrity During a Switchover . . . . . . . . . . . . 82
Look for Array Shift Instructions . . . . . . . . . . . . . . . . . . . 84
Look for Scan-Dependent Logic . . . . . . . . . . . . . . . . . . . 84
Take Preventative Actions . . . . . . . . . . . . . . . . . . . . . . . 85
Determine the Status of Your Redundant System . . . . . . . . . 87
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
Example 1: Ladder Diagram . . . . . . . . . . . . . . . . . . . . . . 87
Example 2: Structured Text. . . . . . . . . . . . . . . . . . . . . . . 87
Check Your Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Condition Logic to Run After a Switchover . . . . . . . . . . . . . . 89
Example 1: Ladder Diagram . . . . . . . . . . . . . . . . . . . . . . 89
Example 2: Structured Text. . . . . . . . . . . . . . . . . . . . . . . 90
Send a Message to the SRM . . . . . . . . . . . . . . . . . . . . . . . . . 91
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Download the Project to the Primary Controller . . . . . . . . . . 95
Schedule a ControlNet Network. . . . . . . . . . . . . . . . . . . . . . 97
Schedule a New Network. . . . . . . . . . . . . . . . . . . . . . . . 97
Update the Schedule of an Existing Network. . . . . . . . . . 98
Check the Keepers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
Save the Project for Each Controller . . . . . . . . . . . . . . . . 99
Set Task Watchdog Times . . . . . . . . . . . . . . . . . . . . . . . . . 100
Chapter 6
Maintain and Troubleshoot the
System
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
Diagnose a Switchover or Disqualification . . . . . . . . . . . . . 104
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Troubleshoot a Failure to Synchronize . . . . . . . . . . . . . . . . 105
Update a Keeper Signature . . . . . . . . . . . . . . . . . . . . . . . . 107
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Edit Sessions in Progress . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Interpret the SRM Event Log . . . . . . . . . . . . . . . . . . . . . . . 109
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
Interpret SRM events . . . . . . . . . . . . . . . . . . . . . . . . . . 113
Export the SRM Event Log . . . . . . . . . . . . . . . . . . . . . . . . . 115
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Manually Synchronize the Chassis . . . . . . . . . . . . . . . . . . . 118
Optimize Communication . . . . . . . . . . . . . . . . . . . . . . . . . 119
Choose a Greater System Overhead Time Slice . . . . . . . 120
Enter a System Overhead Time Slice. . . . . . . . . . . . . . . 121
Make All Your Tasks Periodic. . . . . . . . . . . . . . . . . . . . 122
Publication 1756-UM523F-EN-P - December 2006
8 Table of Contents
Check the Allocation of Unused Memory . . . . . . . . . . . . . . 123
Adjust CPU Usage for a CNB Module . . . . . . . . . . . . . . . . . 123
Use RSLinx Software . . . . . . . . . . . . . . . . . . . . . . . . . . 124
Four-Character Display. . . . . . . . . . . . . . . . . . . . . . . . . 124
Send a Message to the CNB Module . . . . . . . . . . . . . . . 126
Store or Load a Project Using Nonvolatile Memory . . . . . . . 126
Store a Project to Nonvolatile Memory
While a Process Is Running . . . . . . . . . . . . . . . . . . . . . . . . 128
Chapter 7
Update Modules and Redundant
Systems
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Change CNB Modules from Series D to
Series E While Online . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Before You Begin . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
Update a Redundant Control System Offline. . . . . . . . . . . . 136
Update an Online Redundant System . . . . . . . . . . . . . . . . 138
Redundant System Relationships. . . . . . . . . . . . . . . . . . 139
Appendix A
Set Up EtherNet/IP
Communication Across Subnets
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Keep an HMI Communicating with the Primary Chassis . . . 148
Install the ControlLogix Redundancy
Alias Topic Switcher Software. . . . . . . . . . . . . . . . . . . . 149
Configure a Driver to Communicate with the Primary and
Secondary EtherNet/IP Modules . . . . . . . . . . . . . . . . . . 150
Create a DDE/OPC Topic for Each Controller . . . . . . . . 151
Create an Alias Topic . . . . . . . . . . . . . . . . . . . . . . . . . . 152
Set Up the Alias Topic Switcher . . . . . . . . . . . . . . . . . . 153
Address the Alias Topic in the HMI Project . . . . . . . . . . 154
Keep a Message Going to the Primary Chassis . . . . . . . . . . 154
Create a Periodic Trigger for the Messages . . . . . . . . . . 155
Get the Redundancy State of Chassis A . . . . . . . . . . . . 156
Get the Redundancy State of Chassis B . . . . . . . . . . . . . 157
Determine Which Chassis is Primary. . . . . . . . . . . . . . . 159
Send the Message to the Appropriate Controller . . . . . . 160
Appendix B
Convert an Existing System to
Redundancy
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Convert Local Modules to Remote Modules . . . . . . . . . . . . 163
Reconfigure the Local I/O Modules. . . . . . . . . . . . . . . . 164
Replace Local I/O Tags . . . . . . . . . . . . . . . . . . . . . . . . 164
Replace Any Aliases to Local I/O Tags . . . . . . . . . . . . . 166
Publication 1756-UM523F-EN-P - December 2006
Table of Contents 9
Appendix C
Attributes of the Redundancy
Object
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Attributes of the Redundancy Object . . . . . . . . . . . . . . . . . 169
Appendix D
Series B ControlNet Bridge
Modules
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Losing Communication while Bridging Via a
Series B ControlNet
Bridge Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173
Communication Stoppage While Using a Series B ControlNet
Bridge Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
Appendix E
Redundant System Restrictions
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
Redundant System Restrictions. . . . . . . . . . . . . . . . . . . . . . 177
Index
Rockwell Automation Support . . . . . . . . . . . . . . . . . . . . . . 186
Installation Assistance . . . . . . . . . . . . . . . . . . . . . . . . . 186
New Product Satisfaction Return. . . . . . . . . . . . . . . . . . 186
Publication 1756-UM523F-EN-P - December 2006
10 Table of Contents
11 Publication 1756-UM523F-EN-P - December 2006
Preface
Purpose of this Manual
This manual guides the design, development, and implementation of a
redundancy system for a ControlLogix controller.
Who Should Use this
Manual
This manual is intended for those in these professions who design and
develop applications that use ControlLogix controllers:
• Software engineers
• Control engineers
• Application engineers
• Instrumentation technicians
When to Use This Manual
Use this manual throughout the lifecycle of a redundancy system. The
lifecycle consists of these stages:
• Design
• Installation
• Configuration
• Programming
• Testing
• Maintenance and troubleshooting
How to Use this Manual
This manual is divided into the basic tasks performed during the
design, development, and implementation of a ControlLogix
redundancy system.
• Each chapter covers a task.
• Tasks are organized in the sequence you will typically perform
them.
Publication 1756-UM523F-EN-P - December 2006
Preface 12
Related Documentation
This table lists ControlLogix products and documentation that may be
valuable as in programming an application.
To view or download these publications, go to:
http://literature.rockwellautomation.com
To obtain a hard copy, contact your Rockwell Automation distributor
or sales representative.
Catalog Number Title Publication Number
1756-CNB/D and
1756-CNBR/D
ControlLogix ControlNet Bridge Module Installation Instructions 1756-IN571
ControlLogix ControlNet Interface Module Release Notes 1756-RN587
1756-CNB/E and
1756-CNBR/E
ControlLogix ControlNet Bridge Module, Series E Installation Instructions 1756-IN604
ControlLogix ControlNet Bridge Module, Series E Release Notes 1756-RN627
1756-ENBT/A 1756 10/100Mbps EtherNet/IP Bridge, Twisted Pair Media Release Notes 1756-RN602
1756-ENBT 1756-ENBT ControlLogix EtherNet/IP Product Profile 1756-PP004
ControlLogix EtherNet/IP Bridge Module Installation Instructions 1756-IN019
ControlLogix EtherNet/IP Communication Release Notes 1756-RN591
1756-EWEB 1756-EWEB EtherNet/IP Web Server Module Release Notes
1756-RN604
EtherNet/IP Web Server Module Installation Instructions 1756-IN588
EtherNet/IP Web Server Module User Manual ENET-UM527
1756-L55
ControlLogix Controller and Memory Board Installation Instructions 1756-IN101
1756-L61
ControlLogix Controller and Memory Board Installation Instructions
1756-IN101
1756-L62
1756-L63
1756-M12
1756-M13
1756-M14
1756-M16
1756-M22
1756-M23
1756-M24
1757-SRM/B ProcessLogix/ControlLogix System Redundancy Module Installation
Instructions
1757-IN092
13 Publication 1756-UM523F-EN-P - December 2006
Chapter
1
ControlLogix Redundancy System Overview
Introduction
This chapter provides an overview of the ControlLogix redundancy
system, including commonly used terms. It also answers some
common questions about a ControlLogix redundancy system.
Topic Page
About the Main Parts of a Redundant System 14
Firmware Combinations That Make Up a Redundant System 14
Primary Chassis 15
Switching from One Controller to Another 15
Network Access Port 16
Bump in Outputs During a Switchover 16
Keep the Second Controller Up to Date 16
Making Online Edits 18
Increasing Scan Time 18
Network Addresses During a Switchover 18
Quick Start Checklists 21
Publication 1756-UM523F-EN-P - December 2006
14 ControlLogix Redundancy System Overview
About the Main Parts of a
Redundant System
The ControlLogix redundancy system uses an identical pair of
ControlLogix chassis to keep a machine or process running if a
problem occurs with any hardware in one of the chassis.
This diagram illustrates the layout of a simple redundant setup.
ControlLogix Redundant System
Firmware Combinations
That Make Up a Redundant
System
These firmware combinations make up revisions 15.56 and 15.57 of
the ControlLogix redundancy system.
ControlLogix Redundancy Firmware Combinations
Identical Pair of
ControlLogix Chassis that
Controls a Machine or
Process
At Least 2 Other
ControlNet Nodes,
with Node Numbers
That are Lower Than
Those of the Two
1756-CNB Modules in
the Redundant Chassis
Network 2 - ControlNet Network for
I/O Communications
43128
Computer That is Connected to the
Network Access Port of a Remote Node
Network 1 -
EtherNet/IP Network or
ControlNet Network for HMI
Module Catalog Number Series Firmware Revision
ControlLogix5555 controller 1756-L55Mxx Any 15.57
ControlLogix5561 controller 1756-L61 Any 15.56
ControlLogix5562 controller 1756-L62 Any 15.56
ControlLogix5563 controller 1756-L63 Any 15.56
ControlNet bridge module 1756-CNB
1756-CNBR
D7.12
E 11.002
1756 10/100 Mbps EtherNet/IP Bridge, Twisted Pair Media 1756-ENBT Any 4.3
1756 10/100 Mbps EtherNet/IP Bridge w/ Enhanced Web Services 1756-EWEB Any 4.3
Redundancy module 1757-SRM Any 4.3
Publication 1756-UM523F-EN-P - December 2006
ControlLogix Redundancy System Overview 15
Important Terms in a
Redundant System
Redundancy requires no additional programming and is transparent to
any devices connected over an EtherNet/IP or ControlNet network.
Redundancy uses 1757-SRM modules to maintain communication
between the pair of redundant chassis.
In a redundant system, these terms describe the relationship between
the two redundant chassis.
Redundancy Terms
Primary Chassis
In a pair of redundant chassis, the first chassis turned on becomes the
primary chassis. When the secondary chassis receives power, it
synchronizes itself with the primary chassis.
Switching from One
Controller to Another
When primary chassis components fail, control switches to the
secondary controller. A switchover occurs for any of these reasons:
• any of these situations in the primary chassis:
– loss of power
– major fault of the controller
– removal, insertion, or failure of any module in the primary
chassis
– break or disconnection of a ControlNet tap or ethernet cable
• command from the primary controller
• command from RSLinx software
Term Description
Primary Controller The controller that is currently controlling the machine or process.
Primary Chassis The chassis that contains the primary controller or controllers.
Secondary Controller The controller that is standing by to take control of the machine or process. A secondary
controller always resides in a different chassis than the primary controller.
Secondary Chassis The chassis that contains the secondary controller or controllers.
Switchover Transfer of control from the primary controller to the secondary controller. After a
switchover, the controller that takes control becomes the primary controller. Its partner
controller (the controller that was previously the primary controller) becomes the
secondary controller.
Publication 1756-UM523F-EN-P - December 2006
16 ControlLogix Redundancy System Overview
Network Access Port
To connect a device to the network access port (NAP) of a
1756-CNB/D/E or 1756-CNBR/D/E module, use an NAP that is outside
of a redundant chassis.
Bump in Outputs During a
Switchover
Depending on how you organize your RSLogix 5000 project, outputs
may or may not experience a change in state (bump) during a
switchover.
• During the switchover, outputs controlled by the highest priority
task experience a bump-free switchover. For example, outputs
do not revert to a previous state.
• Outputs in lower priority tasks may experience a change of
state.
The switchover time of a redundant system depends on the type of
failure and the network update time (NUT) of the ControlNet network.
For a NUT of 10 ms, the switchover time is approximately 80...220 ms.
Keep the Second Controller
Up to Date
To take over control, the secondary controller requires the same
project as the primary controller. It also requires up-to-date tag values.
These terms describe the process of communication between the two
controllers.
IMPORTANT
Use of the Network Access Port (NAP)
Do not connect any device to the network access port (NAP) of
a 1756-CNB/D/E or -CNBR/D/E module in a redundant chassis.
• If you connect a device to the NAP of a CNB module in a
redundant chassis, a switchover will fail to occur if the
CNB module is disconnected from the network. While
the CNB module is disconnected from the network, the
controller will be unable to control any I/O devices
through that CNB module.
• If you connect a workstation to the NAP of a CNB
module in a redundant chassis, the workstation will be
unable to go online after a switchover.
To connect a device to a ControlNet network via a NAP, use a
NAP that is outside of a redundant chassis.
Publication 1756-UM523F-EN-P - December 2006
ControlLogix Redundancy System Overview 17
Controller Communication Terms
The 1757-SRM modules keep communication between the primary
and secondary chassis.
• Unless you are updating controller revisions, do not download
the project to the secondary controller. While the secondary
controller is synchronizing with the primary controller, the
1757-SRM modules automatically let the primary controller
transfer the project to the secondary controller.
• Once the secondary controller is synchronized, the 1757-SRM
modules keep the controller synchronized by providing the path
for crossloading any changes that occur in the primary
controller. These changes include:
– online edits.
– force values.
– changes to properties.
– changes to data.
– results of logic execution.
Term Description
Crossload The transfer of any or all of the contents of the primary
controller to the secondary controller. This could be updated
tag values, force values, online edits, or any other information
about the project. A crossload happens initially when the
chassis synchronize and then repeatedly as the primary
controller executes its logic.
Synchronize The process that readies a secondary chassis to take over
control if a failure occurs in the primary chassis. During
synchronization, the 1757-SRM modules check that the partner
modules in the redundant chassis pair are compatible with
each other. The SRM modules also provide the path for
crossloading (transferring) the content of the primary controller
to the secondary controller.
Synchronization occurs when power is applied to the secondary
chassis and after a switchover is diagnosed and fixed.
Synchronized The secondary chassis is ready to assume control if the primary
chassis fails.
Disqualified The secondary chassis is not synchronized with the primary
chassis. If a secondary chassis is disqualified, it cannot take
over control of the machine or process. A secondary chassis
can be manually disqualified.
Qualify Same as synchronize.
Qualified Same as synchronized.
1757-SRM Modules
Primary Chassis
43129
Secondary Chassis
Crossload
Publication 1756-UM523F-EN-P - December 2006
18 ControlLogix Redundancy System Overview
Making Online Edits
Online edits automatically crossload to the secondary controller. They
become inactive if a switchover happens before you assemble them
into the project. This stops a mistake from faulting both the old and
new primary controllers.
Suppose you test an online edit and it causes the controller to fault. In
that case, a switchover happens. The new primary controller
automatically untests the edits and goes back to the original code.
You have the option to keep the edits active after a switchover (at the
risk of faulting both controllers).
Increasing Scan Time
At the end of each program, the primary controller pauses its
execution to crossload the result of any output instruction that
executed in the program. This results in an increased program scan
time for a synchronized redundancy system.
Scan Time
Network Addresses During
a Switchover
Each CNB, ENBT, or EWEB module in a redundant chassis shares a
pair of network addresses with its partner in the other chassis.
Execute Program in
Primary Controller
Start of Program End of Program
Crossload Results to
Secondary Controller
Program Scan Time
Publication 1756-UM523F-EN-P - December 2006
ControlLogix Redundancy System Overview 19
ControlNet Network
24
4
2
3
5
6
7
0
1
4
2
3
5
6
7
0
1
Workstations and HMIs continue to connect
to the same node number.
Secondary
Chassis
CNB modules in the primary chassis
use the node number to which they
are set.
4
2
3
5
6
7
0
1
4
2
3
5
6
7
0
1
CNB modules in the secondary chassis use the
node number to which they are set plus
1.
Primary
Chassis
25
Set each pair of CNB modules to
the same node number.
25
Primary
Chassis
CNB modules swap node numbers.
CNB modules swap node numbers.
Secondary
Chassis
24
Switchover
Workstations and HMIs continue to connect
to the same node number.
Publication 1756-UM523F-EN-P - December 2006
20 ControlLogix Redundancy System Overview
EtherNet/IP Network
E
N
B
T
An EtherNet/IP module in the primary
chassis uses the IP address to which
it is set.
An EtherNet/IP module in the
secondary chassis uses the IP address
to which it is set + 1 in the last address
segment.
Port Configuration
Switchover
EtherNet/IP Modules
Primary
Chassis
Secondary
Chassis
E
N
B
T
Port Configuration
Set both EtherNet/IP modules to the
SAME IP address.
10.10.10.10 10.10.10.11
Secondary
Chassis
E
N
B
T
Primary
Chassis
E
N
B
T
10.10.10.
11 10.10.10.10
Publication 1756-UM523F-EN-P - December 2006
ControlLogix Redundancy System Overview 21
Quick Start Checklists
These checklists provide a summary of the criteria for a successful
ControlLogix redundancy system. See the remaining chapters for more
information on each parameter.
System Layout
Parameter Criteria Page
ControlNet Networks • ControlNet networks are the primary networks for the system.
• OK to bridge to devices on other networks, such as DeviceNet, Universal Remote I/O,
and DH+ networks.
• Networks follow the guidelines in Logix5000 Controllers Design Considerations,
publication 1756-RM094.
28, 31
I/O Placement • All I/O modules in remote chassis or DIN rails (no I/O in the local chassis)
• All I/O in only these locations:
• Same ControlNet network as the redundant controllers (no bridging)
• DeviceNet network (via a 1756-DNB module in a remote chassis)
• Universal remote I/O network (via a 1756-DHRIO module in a remote chassis)
28, 31
ControlNet Network Update
Tim es
• NUTs ≤ 90 ms
• NUTs ≤ specified relationship to each other
35
Number of ControlNet Nodes At least 2 nodes on each network in addition to the CNBs in the redundant chassis. For
example, each ControlNet network has at least 4 nodes.
35
ControlNet Node Assignments • Nonredundant nodes use the lowest node numbers.
• CNB modules in the redundant chassis set close to the scheduled network maximum
(SMAX).
• 2 consecutive node addresses for each set of partner CNB modules (one in each
chassis).
• Switches of each partner CNB module set to the same node address.
18, 35
Network Access Ports No devices connected to the network access ports of CNB modules in the redundant
chassis.
28
EtherNet/IP Networks EtherNet/IP networks are only for HMIs, workstations, and messaging (no control of I/O).
No EtherNet/IP network for:
• control of I/O.
• peer interlocking (produced and consumed tags).
28, 38
Publication 1756-UM523F-EN-P - December 2006
22 ControlLogix Redundancy System Overview
Redundant Chassis Configuration
Parameter Criteria Page
Chassis Size Same size chassis for each pair of redundant chassis. 29
Chassis Layout • Only these modules in each redundant chassis:
• Controllers
• ControlNet modules
• EtherNet/IP modules
• System redundancy module (needs 2 slots)
• Each chassis within a redundant pair looks the same.
• Identical modules (same catalog number, series, revision, and memory size)
• Same slot assignments
29
System Redundancy
Modules
1757-SRM module:
• 1 in each redundant chassis
• Needs 2 slots
• Needs 1757-SRCx cable [1 m (3 ft), 3 m (9 ft), 10 m (30 ft), 50 m (150 ft), and 100 m (300 ft)]
29, 30
Controllers ControlLogix5555, ControlLogix5561, ControlLogix5562, or ControlLogix5563 controllers
• Which type of controller do you want to use?
• If ControlLogix5555, then 1 or 2 controllers in each redundant chassis.
• If ControlLogix5561, ControlLogix5562, or ControlLogix5563, then only 1 controller in
each redundant chassis.
• Same type of controller throughout the chassis.
• Enough memory for 2 copies of all data.
• 7 connections for redundancy.
29
ControlNet Modules 1756-CNB/D/E or 1756-CNBR/D/E module or modules:
• CPU usage ≤ 75%.
• CNB modules have the same keeper information.
•≤ 5 CNB modules. See also parameter .
29, 107,
123
Publication 1756-UM523F-EN-P - December 2006
ControlLogix Redundancy System Overview 23
EtherNet/IP Modules 1756-ENBT or 1756-EWEB modules:
• Which modules do you want to use?
• If 1756-ENBT, catalog revision greater than or equal to E01 (E01, E02, …, F01). See the
label on the side of the module or its box.
• If 1756-EWEB, any catalog revision.
• Up to 2 EtherNet/IP modules in each redundant chassis, within these limits.
29, 38
Redundant Chassis Configuration (Continued)
Parameter Criteria Page
If you have Use up to
1 ControlNet module 2 EtherNet/IP modules
2 ControlNet modules 2 EtherNet/IP modules
3 ControlNet modules 2 EtherNet/IP modules
4 ControlNet modules 1 EtherNet/IP module
5 ControlNet modules No EtherNet/IP modules
Do not use more than 5 ControlNet
modules.
Publication 1756-UM523F-EN-P - December 2006
24 ControlLogix Redundancy System Overview
RSLogix5000 Project
Parameter Criteria Page
Number of Projects Only one RSLogix 5000 project for the pair of redundant controllers. The project automatically
crossloads to the secondary controller when the secondary controller synchronizes with the
primary controller.
65
Controller Properties • ControlLogix5555, ControlLogix5561, ControlLogix5562, or ControlLogix5563 controller.
• Redundancy enabled.
68
Task Structure • Only one task at the highest priority.
• If more than one task, all tasks periodic.
70, 76,
119
I/O • Outputs that require a bumpless switchover are in the highest priority task.
• Requested packet interval (RPI) less than or equal to 375 milliseconds. (Larger RPIs may
produce a bump at switchover.).
70
Task Watchdog Time Watchdog time ≥ (2 * maximum_scan_time) + 150 ms
where:
Maximum_scan_time is the maximum scan time for the entire task when the secondary
controller is synchronized.
100
Minimizing Scan Time • A few large programs instead of a lot of small programs.
• No unused tags.
• Arrays and user-defined data types instead of individual tags.
• User-defined data types as compact as possible.
• Code as compact as possible.
• Code runs only when you need it.
• Data grouped by how often you need it.
• DINT tags instead of SINT or INT tags.
76
Data Integrity Special treatment for:
• Bit Shift Left (BSL) and Bit Shift Right (BSR) instructions.
• FIFO Unload (FFU) instructions.
• logic that is scan dependent.
82
Produced and Consumed
Tags
If you want a controller in another chassis to consume a tag from the redundant controller, use
a comm format of None. In the I/O configuration of the consuming controller, select a comm
format of None for the remote CNB module (the CNB that is physically in the redundant
chassis). This comm format of None is only available over a ControlNet network.
70
Message (MSG)
Instructions
For any MSG instruction from a controller in another chassis to a redundant controller, cache
the connection.
70
Publication 1756-UM523F-EN-P - December 2006
ControlLogix Redundancy System Overview 25
Operator Interface Terminals
Parameter Operator Interfaces Criteria Page
EtherNet/IP Network PanelView Standard terminal Same as a nonredundant system 28, 32, 38
• PanelView Plus terminal
• VersaView industrial computer running a
Windows CE operating system
• Use RSLinx Enterprise software revision
3.0 or later.
• Set aside connections for each PanelView
Plus or VersaView CE terminal:
RSView Supervisory Edition software with
RSLinx Enterprise software
• Use RSLinx Enterprise software revision
3.0 or later.
• Use IP swapping.
• Keep the HMI and both redundant chassis
on the same subnet.
• RSView Supervisory Edition software with
RSLinx 2.x software
• RSView 32 software
• Any other HMI client software that uses
RSLinx 2.x software
Limit the number of RSLinx servers that a
controller uses to 1 (ideal) to 3 (maximum).
ControlNet Network • PanelView Standard terminal
• PanelView 1000e/1400e terminal
Do terminals use unscheduled
communication?
• Yes — U se ≤ 4 terminals per controller.
• No — Use the number of terminals that
you need.
28, 32, 35
• PanelView Plus terminal
• VersaView industrial computer running a
Windows CE operating system
• Use RSLinx Enterprise software revision
3.0 or later.
• Set aside connections for each PanelView
Plus or VersaView CE terminal.
• RSView Supervisory Edition software with
RSLinx 2.x software
• RSView 32 software
• Any other HMI client software that uses
RSLinx 2.x software
Limit the number of RSLinx servers that a
controller uses to 1 (ideal) to 3 (maximum).
In this module Set aside
controller 5 connections
ENBT 5 connections
EWEB 5 connections
In this module Set aside
Controller 5 connections
CNB 5 connections
Publication 1756-UM523F-EN-P - December 2006
26 ControlLogix Redundancy System Overview
Notes:
27 Publication 1756-UM523F-EN-P - December 2006
Chapter
2
Design the System
Introduction
This chapter explains how to design a redundancy system for a
ControlLogix controller.
Topic Page
Laying Out the System 28
Placement of a Pair of Redundant Chassis 30
Placement of the I/O 31
Placement of Operator Interface Terminals 32
Additional Redundant Components 33
Checking Connection Requirements 35
Planning a ControlNet Network 35
Planning an EtherNet/IP Network 38
Additional Design Considerations 41
Publication 1756-UM523F-EN-P - December 2006
28 Design the System
Laying Out the System
ControlLogix Redundancy Requirements and Recommendations
C
N
B
E
N
B
I/O Modules
D
N
B
D
H
R
I
O
M
V
I
Other Networks
Remote location for all:
• I/O
• DNB, DHRIO, & MVI
communication modules
Assign the lowest node numbers
to nonredundant nodes.
An additional node can be:
• a second CNB module in the same remote chassis or in a different remote chassis.
• any other ControlNet device (not required to be keeper capable).
ControlNet network:
• Set NUT ≤ 90 ms
• Set RPIs ≤ 375 ms
• If multiple ControlNet
networks, set NUTs
≤ specified values.
For unscheduled communication,
use ≤ 4 PanelView terminals per
controller.
At least 2 nodes in
addition to the CNBs in
the redundant chassis
Multiple redundant chassis
pairs are OK.
Use separate networks for unscheduled and scheduled
communication.
• For unscheduled communication (HMI, workstations,
message instructions), use either an EtherNet/IP or a
ControlNet network.
• For scheduled communications (I/O, produced/consumed
tags), use a ControlNet network.
To connect a computer to the
network via an NAP, use a remote
node.
EtherNet/IP ControlNet
ControlNet
or
Unscheduled Communication
Scheduled Communication
Publication 1756-UM523F-EN-P - December 2006
Design the System 29
ControlLogix Redundancy Requirements and Recommendations (Continued)
1757-SRCx cable is available in
1 m (3 ft), 3 m (9 ft), 10 m (30 ft), 50 m
(150 ft), and 100 m (300 ft) lengths.
L
•
•
•
E
N
B
T
S
R
M
Redundant
Chassis A
Redundant
Chassis B
No Other Modules
1756-CNB/D/E or 1756-CNBR/D/E module or modules:
• 1-5 in each redundant chassis.
•≤ 5 total communication modules (CNBs, ENBTs, and
EWEBs) in each redundant chassis.
• Keep CPU usage ≤ 75%.
• Allocate 2 consecutive node addresses for each set of
partner CNB modules (one in each chassis).
• Assign each partner CNB module to the same node
address.
• Assign the higher node addresses in the system to the
CNB modules in the redundant chassis.
1757-SRM module:
• Only 1 in each redundant chassis
• Uses 2 slots
ControlLogix5555, ControlLogix5561, ControlLogix5562, or
ControlLogix5563 controllers:
• Same type of controller throughout the chassis.
• If ControlLogix5555, then 1 or 2 controllers in each
redundant chassis.
• If ControlLogix5561, ControlLogix5562, or
ControlLogix5563, then only 1 controller in each
redundant chassis.
• Enough memory for 2 copies of all data.
• 7 connections for redundancy.
C
N
B
L
•
•
•
E
N
B
T
S
R
M
No Other Modules
C
N
B
Same Size of Chassis
Identical Modules:
• Same Slot Number
• Same Catalog Number, Series, and Revision
• Same Memory Size (controller)
1756-ENBT or 1756-EWEB modules:
• 1- 2 in each redundant chassis.
•≤ 5 total communication modules (CNBs and ENBTs) in each
redundant chassis.
• For 1756-ENBT modules, catalog revision must be greater than
or equal to E01 (E01, E02, …, F01). See the side of the module
or its box.
• Requires RSLinx software, version 2.50.
Publication 1756-UM523F-EN-P - December 2006
30 Design the System
Placement of a Pair of
Redundant Chassis
With the standard redundancy module cables, a pair of redundant
chassis (primary and secondary) can function up to 100 m (300 ft)
apart.
Redundant Chassis Placement
If You Need More Than 100 Meters Between Chassis
To place the primary and secondary controller chassis more than 100
meters apart, use a custom fiber optic cable. For a custom cable,
follow these rules:
• Keep total light loss through the cable less than or equal to 7dB.
• Keep total length less than or equal to 4 km.
• Use high quality 62.5/125 micron multi-mode fiber-optic cable.
• Use professionally installed SC-style connectors to connect to
the 1757-SRM modules.
Redundancy Module Cable:
• 1757-SRC1 cable - 1 m (3 ft)
• 1757-SRC3 cable - 3 m (9 ft)
• 1757-SRC10 cable - 10 m (30 ft)
• 1757-SRC50 cable - 50 m (150 ft)
• 1757-SRC100 cable - 100 m (300 ft)
L
•
•
•
E
N
B
T
S
R
M
Redundant
Chassis A
Redundant
Chassis B
No Other Modules
C
N
B
L
•
•
•
E
N
B
T
S
R
M
No Other Modules
C
N
B
Publication 1756-UM523F-EN-P - December 2006
Design the System 31
Placement of the I/O
In a ControlLogix redundancy system, place all I/O in only these
locations:
• Same ControlNet network as the redundant controllers (no
bridging to I/O modules on another ControlNet network)
• DeviceNet network
• Universal remote I/O network
IO Placement
HMI – Yes
Universal Remote I/O Network
I/O – Yes
HMI – Yes
DeviceNet Network
I/O – Yes
C
N
B
D
N
B
I/O Modules
C
N
B
E
N
B
D
H
R
I
HMI – Yes
EtherNet/IP Network
I/O – No
HMI – Yes
I/O – No
ControlNet Network
Redundant Chassis Pair
Remote Chassis
ControlNet Network
Publication 1756-UM523F-EN-P - December 2006
32 Design the System
Placement of Operator
Interface Terminals
For operator interface terminals, stay within these limitations.
Operator Interface Terminal Limitations
Network Operator Interfaces Guidelines
EtherNet/IP network PanelView Standard terminal Same as a nonredundant system
• PanelView Plus terminal
• VersaView industrial computer running a
Windows CE operating system
• Use RSLinx Enterprise software revision 3.0 or
later.
• Set aside connections for each PanelView Plus or
VersaView CE terminal.
RSView Supervisory Edition software with RSLinx
Enterprise software
• Use RSLinx Enterprise software revision 3.0 or
later.
• Use IP swapping.
• Keep the HMI and both redundant chassis on the
same subnet.
• RSView Supervisory Edition software with
RSLinx 2.x software
• RSView 32 software
• Any other HMI client software that uses
RSLinx 2.x software
Limit the number of RSLinx servers that a controller
uses to 1 (ideal) to 3 (maximum).
ControlNet network • PanelView Standard terminal
• PanelView 1000e/1400e terminal
Do your terminals use unscheduled communication?
• Yes — Use ≤ 4 terminals per controller.
• No — Use the number of terminals that you need.
• PanelView Plus terminal
• VersaView industrial computer running a
Windows CE operating system
Set aside connections for each PanelView Plus or
VersaView CE terminal.
• RSView Supervisory Edition software
• RSView 32 software
• Any other HMI client software that uses
RSLinx 2.x software
Limit the number of RSLinx servers that a controller
uses to 1 (ideal) to 3 (maximum).
In this module Set aside
Controller 5 connections
CNB 5 connections
ENBT 5 connections
EWEB 5 connections
In this module Set aside
Controller 5 connections
CNB 5 connections
Publication 1756-UM523F-EN-P - December 2006
Design the System 33
Additional Redundant
Components
In addition to using redundant pairs of controllers, you may also add
these redundant components to your system:
• Redundant ControlNet Media
• Redundant Power Supplies
Redundant ControlNet Media
Redundant ControlNet media prevents a loss of communication if a
trunkline or tap is severed or disconnected. It uses these components:
• 1756-CNBR ControlNet modules
• Two identical ControlNet links
Redundant ControlNet Media Components
ControlLogix Chassis with
1756-CNBR Module
Redundant Media
ControlNet Node
ControlNet Node
Publication 1756-UM523F-EN-P - December 2006
34 Design the System
Redundant Power Supplies
Redundant power supplies let you maintain power to a ControlLogix
chassis if a power supply fails. Redundant power supplies use these
supplies:
• Two redundant power supplies, any combination of 1756-PA75R
and 1756-PB75R.
• 1756-PSCA chassis adapter module, in place of the standard
power supply.
• Two 1756-CPR cables to connect the power supplies to the
1756-PSCA adapter.
• User-supplied annunciator wiring to connect the power supplies
to the input modules if needed.
Redundant Power Supplies
1756-PA75R or
1756-PB75R
Power Supply
ControlLogix Chassis
with 1756-PSCA Module
1756-CPR Cable
1756-PA75R or
1756-PB75R
Power Supply
Annunciator Wiring
1756 Digital
Input Module
Publication 1756-UM523F-EN-P - December 2006
Design the System 35
Checking Connection
Requirements
Set aside seven connections in each redundant controller for
redundancy communication.
• Two connections for the SRM
• Five connections for the partner controller
Planning a ControlNet
Network
Follow these guidelines to plan a ControlNet network.
ControlNet Network Guidelines
Guideline Details
Make sure the network has at least 2 nodes plus the
redundant chassis pair.
An additional node can be:
• a second CNB module in the same remote chassis or in a different remote
chassis.
• any other ControlNet device.
• a workstation that is running RSLinx software.
If your ControlNet network contains only one node other than the redundant
chassis pair, that node will drop its connections during a switchover. This may
cause the outputs of that node to change state during the switchover.
Give the lowest ControlNet addresses to I/O chassis and
other remote chassis.
Do not give the lowest addresses to the redundant chassis pair.
If you give the lowest address to a CNB module in the redundant chassis pair:
• on a switchover, you may temporarily lose communication with I/O
modules, produced tags, and consumed tags.
• If you remove the CNB module from the primary chassis while chassis
power is on, you may temporarily lose communication with I/O modules,
produced tags, and consumed tags.
• If every ControlNet node powers down at the same time (for example, a
plant-wide power loss), you may have to cycle the power to the primary
chassis to restore communication.
Publication 1756-UM523F-EN-P - December 2006
36 Design the System
Set aside 2 consecutive ControlNet addresses for each
pair of redundant chassis (for example, nodes 3 and 4).
• If each redundant chassis has multiple CNB modules, set aside a pair of
node numbers for each pair of CNB modules (one in each chassis).
• Do not configure any other device on the ControlNet network for either of
these addresses. For example, if you allocated nodes 3 and 4 for the
redundant chassis, then no other device should use those node numbers.
Know that the switchover time depends on the NUT of
the ControlNet network.
Use the network update time (NUT) of the ControlNet network to estimate
how long it takes your system to switchover.
Example 1
The chassis loses power and the NUT = 4 ms. In that case, the switchover
time is approximately 60 ms.
Example 2
The chassis loses power and the NUT = 10 ms. In that case, the switchover
time is approximately 80 ms.
Example 3
You unplug the CNB from the network and the NUT = 10 ms. In that case, the
switchover time is approximately 220 ms.
Use a NUT that is less than or equal to 90 ms. If you use a larger network update time (NUT), the controller could lose its
connection with a module during a switchover. This could cause outputs to
change state.
Guideline Details
Pair of CNB modules (one in each
redundant chassis)
Slot and node numbers
Slot # Primary node # Secondary node #
(primary node # + 1)
1st pair of CNB modules
2nd pair of CNB modules
3rd pair of CNB modules
4th pair of CNB modules
5th pair of CNB modules
If And the NUT is Then the switchover time is
The chassis loses power or
a module fails
6 ms or less 60 ms
7 ms or more 5 (NUT ) + MAX (2 (NUT ), 30)
A CNB module cannot
communicate with any
other node
⇒ 14 (NUT ) + MAX (2 (NUT ), 30) + 50
Publication 1756-UM523F-EN-P - December 2006
Design the System 37
Do the redundant chassis use more than 1 ControlNet
network?
• Yes — See page 29.
• No — Skip this guideline.
The NUT of each network must be within the values indicated on page 29. If
you use a larger network update time (NUT), the controller could lose its
connection with a module during a switchover. This could cause outputs to
change state.
Example
Guideline Details
If the NUT of this network is 5 ms…
ControlNet
Network 1
Then the NUT of this network must be
21 ms or less.
ControlNet
Network 2
If the smallest
NUT on a network
is (ms)
Then the largest NUT on any other
network must be less than or equal
to (ms)
215
317
419
521
623
725
827
929
10 31
11 33
12 35
13 37
14 39
15 41
16 43
17 46
18 48
19 50
20 52
21 55
22 57
23 59
24 62
25 64
26 66
27 68
28 71
29 73
30 75
31 78
32 80
33 82
34 84
35 87
36 89
37...90 90
If the smallest
NUT on a network
is (ms)
Then the largest NUT on any other
network must be less than or equal
to (ms)
Publication 1756-UM523F-EN-P - December 2006
38 Design the System
Planning an EtherNet/IP
Network
Follow these guidelines as you plan your EtherNet/IP network.
EtherNet/IP Network Guidelines
Guideline Details
Use EtherNet/IP only for HMIs, workstations, and
messaging.
In a redundant system, use an EtherNet/IP network only for HMI, workstation,
and message communication. Do not use an EtherNet/IP network for:
• control of I/O modules.
• peer interlocking (produced and consumed tags).
Important: RSLogix 5000 software lets you set up and download a project
that tries to use an EtherNet/IP network for I/O, produced tags, or consumed
tags. Those communications do not work however.
Are communication delays OK during a switchover?
If Yes, then continue with EtherNet/IP.
If No, then use ControlNet.
Communication stops over an EtherNet/IP network with your controllers and
HMIs during a switchover.
• You will not be able to communicate with them for up to a minute.
• The actual delay depends on your network topology.
If you need bumpless communication, use a ControlNet network.
If you need a redundant network, use ControlNet. 2 EtherNet/IP modules in same chassis does not give you redundant
EtherNet/IP communication. A switchover still happens if one of the modules
fails or a cable breaks.
See How an EtherNet/IP Module Handles a Cable Break on page 40.
Make sure that your ENBT modules are catalog revision
E01 or later.
To use a 1756-ENBT module in a redundant controller chassis, make sure the
catalog revision of the module is greater than or equal to E01 (E01, E02, …,
F01).
• To find the catalog revision, look at the label on the side of the module or
box.
• If you use an older ENBT module, your secondary chassis will not
synchronize.
ControlLog
1756-ENBT
CAT. NO./SERIES
E01
CAT. REV.
Ethernet/IP 10/100
Catalog Revision
Publication 1756-UM523F-EN-P - December 2006
Design the System 39
Worksheet for IP Swapping
Decide how to handle IP addresses. If both redundant chassis are on Then
Same subnet
Use IP swapping.
During a switchover the primary and
secondary modules swap IP
addresses. This lets you use the same
IP address regardless of which
chassis is primary.
See the next guideline for details.
Different subnets
Do not use IP swapping.
You must change to the new primary
address after a switchover. Use
ControlLogix Redundancy Alias Topic
Switcher software to do this. See
Appendix A.
If you are using IP swapping, give the same IP address to
the primary module and its partner.
A. Give the same IP address, subnet mask, and gateway address to both
modules in the redundant pair.
B. Leave the next highest IP address open for the secondary module.
The module in the secondary chassis automatically uses the IP address of the
primary + 1.
Guideline Details
Switch
Primary
Chassis
Secondary
Chassis
Switch
Router
Switch
Primary
Chassis
Secondary
Chassis
For example
Set the primary and secondary
modules to:
10.10.10.10
Leave this open for the secondary: 10.10.10.11
Pair of ENBT or EWEB Modules
(one in each redundant chassis)
Slot # Configuration
Primary
IP Address
Secondary IP Address
(primary address + 1)
Subnet Mask Gateway
Address
1st pair of ENBT or EWEB modules
2nd pair of ENBT or EWEB modules
Publication 1756-UM523F-EN-P - December 2006
40 Design the System
How an EtherNet/IP Module Handles a Cable Break
An EtherNet/IP module looks for a carrier signal only from the closest
switch. It does not know the health of the network beyond that point.
Data does not have to be flowing.
If the EtherNet/IP module:
• gets the carrier signal, it considers the network as OK.
• does not get the carrier signal, it shows Link lost.
/LQNORVW/LQNORVW
VZLWFK
SULPDU\FKDVVLV
VHFRQGDU\FKDVVLV
ZLOOGLVTXDOLI\
ZRQ¶WV\QFKURQL]H
(WKHU1HW,3PRGXOH
VKRZV
/LQNORVW
ZLOOVZLWFKRYHU
ZRQ¶WV\QFKURQL]H
(WKHU1HW,3PRGXOH
VKRZV
/LQNORVW
URXWHU
VZLWFK
VZLWFK
ZRQ¶WVZLWFKRYHU
ZLOOV\QFKURQL]H
+0,FDQ¶WFRPPXQLFDWHZLWK
SULPDU\FKDVVLV
ZRQ¶WVZLWFKRYHURUGLVTXDOLI\WKH
VHFRQGDU\FKDVVLV
ZLOOV\QFKURQL]H
+0,ZRQ¶WEHDEOHWRFRPPXQLFDWH
ZLWKWKLVFKDVVLVLILWEHFRPHVSULPDU\
6XEQHW$ 6XEQHW%
C
One switch
One subnet
Several switches
Several subnets
Publication 1756-UM523F-EN-P - December 2006
Design the System 41
Additional Design
Considerations
Keep these things in mind as you design your system.
Additional Design Considerations
Switchover always triggers an event
task in a remote, nonredundant
controller.
A switchover triggers an event task under this combination of circumstances:
• The event task is in a nonredundant controller. An event task is not permitted in a redundant
controller.
• A redundant controller triggers the event task via a produced tag.
This occurs regardless of how you configure the produced tag.
Simultaneous branch delays the
execution of a higher priority task.
Both configurations always trigger an
event task during a switchover.
In an SFC, each path of a simultaneous branch delays
the execution of a higher priority task by up to 25 μs.
Publication 1756-UM523F-EN-P - December 2006
42 Design the System
Notes:
43 Publication 1756-UM523F-EN-P - December 2006
Chapter
3
Install the System
Introduction
This chapter explains how to install the hardware of a ControlLogix
redundancy system.
Preliminary Information
Topic Page
Preliminary Information 43
Install the Chassis for the Controllers 45
Install Modules in the First Redundant Chassis 46
Install Modules in the Second Redundant Chassis 48
Install the Remote Chassis or Rails 49
Configure EtherNet/IP Modules 50
Flash the Modules 51
Check the Installation 51
IMPORTANT
Use of the Network Access Port (NAP)
Do not connect any device to the network access port (NAP) of
a 1756-CNB/D/E or 1756-CNBR/D/E module in a redundant
chassis.
• If you connect a device to the NAP of a CNB module in a
redundant chassis, a switchover will fail to occur if the CNB
module is disconnected from the network. While the CNB
module is disconnected from the network, the controller
will be unable to control any I/O devices through that CNB
module.
• If you connect a workstation to the NAP of a CNB module in
a redundant chassis, the workstation will be unable to go
online after a switchover.
To connect a device to a ControlNet network via a NAP, use a
NAP that is outside of a redundant chassis.
Publication 1756-UM523F-EN-P - December 2006
44 Install the System
This chapter provides the sequence of tasks and the critical actions for
the successful installation of a ControlLogix redundancy system. It
does not replace the installation instructions for the components of
the system. During installation, refer to these publications.
Installation Publications
Installation instructions provide important information, such as
detailed installation steps, safety considerations, enclosure
requirements, and hazardous location information.
Before installing the system, review these guidelines for safe handling
of ControlLogix components.
Install this component According to this publication
1756-A4, -A7, -A10, -A13, or -A17 chassis ControlLogix Chassis Installation Instructions, publication 1756-IN080
1756-PA72 or -PB72 power supply ControlLogix Power Supplies Installation Instructions, publication 1756-5.67
1756-PA75 or -PB75 power supply ControlLogix Power Supplies Installation Instructions, publication 1756-5.78
ControlLogix controller ControlLogix Controller and Memory Board Installation Instructions, publication
1756-IN101
1756-CNB/D/E or -CNBR/D/E module ControlLogix ControlNet Bridge Installation Instructions, publication 1756-IN571
1756-ENBT module ControlLogix EtherNet/IP Bridge Module Installation Instructions, publication
1756-IN019
1756-EWEB module EtherNet/IP Web Server Module Installation Instructions, publication 1756-IN588
1757-SRM module ProcessLogix/ControlLogix System Redundancy Module Installation Instructions,
publication 1757-IN092
WARNING
When you insert or remove a module while backplane power is
on, an electrical arc can occur. This could cause an explosion in
hazardous location installations. Be sure that power is removed
or the area is nonhazardous before proceeding.
Publication 1756-UM523F-EN-P - December 2006
Install the System 45
Repeated electrical arcing causes excessive wear to contacts on both a
module and its mating connector. Worn contacts may create electrical
resistance that can affect module operation.
Install the Chassis for the
Controllers
1. Install the two ControlLogix chassis (redundant) that will contain
the controllers.
• Place the chassis within the length of a 1757-SRCx cable.
• Install each chassis according to the ControlLogix Chassis
Installation Instructions, publication 1756-IN080.
• If you are converting an existing system that contains local
I/O modules, you still need two additional chassis. In a
redundant system, you must place all I/O modules outside
the redundant chassis pair.
ATTENTION
Preventing Electrostatic Discharge
This equipment is sensitive to electrostatic discharge, which
can cause internal damage and affect normal operation. Follow
these guidelines when you handle this equipment:
• Touch a grounded object to discharge potential static.
• Wear an approved grounding wriststrap.
• Do not touch connectors or pins on component boards.
• Do not touch circuit components inside the equipment.
• If available, use a static-safe workstation.
• When not in use, store the equipment in appropriate
static-safe packaging.
1.
42798
2.
Publication 1756-UM523F-EN-P - December 2006
46 Install the System
2. For each chassis, install a ControlLogix power supply according
to the corresponding installation instructions.
Install Modules in the First
Redundant Chassis
1. Set the rotary switches of each of the 1756-CNB/D/E or
1756-CNBR/D/E modules to the primary node number plus one.
For example, modules 3 and 4 have a primary node number of
2. If you allocate nodes 3 and 4 for the redundant chassis, set
both CNB modules to node 3.
Power Supply Publication
1756-PA72 ControlLogix Power Supplies Installation Instructions, publication
1756-IN078B
1756-PB72
1756-PA75R ControlLogix Redundant Power Supply Installation Instructions,
publication 1756-IN573C
1756-PB75R
IMPORTANT
We recommend constant power supply to one of the redundant
chassis to maintain uninterrupted operation of the redundant
controller parts.
IMPORTANT
Set the rotary switches of the 1756-CNB/D/E or
1756-CNBR/D/E modules for both redundant chassis to the
same node address.
The primary node number is the node number of the primary
chassis.
42796
Nodes 3 and 4
2.
3.
C
N
B
This is only an example. You can install the
module in any slot.
Publication 1756-UM523F-EN-P - December 2006
Install the System 47
2. Install a 1756-CNB/D/E or 1756-CNBR/D/E module. See
ControlLogix ControlNet Bridge Installation Instructions,
publication 1756-IN571.
3. Connect the CNB module to the ControlNet network.
4. Install the controller or controllers. See ControlLogix Controller
and Memory Board Installation Instructions, publication
1756-IN101.
5. Install the 1756-ENBT or 1756-EWEB module or modules (2
maximum), if required. Connect each module to an ethernet
switch.
6. Install the 1757-SRM module. See ProcessLogix/ControlLogix
System Redundancy Module Installation Instructions, publication
1757-IN092.
WARNING
If you connect or disconnect the communications cable with
power applied to this module or any device on the network, an
electrical arc can occur. This could cause an explosion in
hazardous location installations.
Be sure that power is removed or the area is nonhazardous
before proceeding.
4.
42799
L
5
5
S
R
M
C
N
B
6.
This is only an example. You can install the
modules in any slot.
E
N
B
T
5.
Publication 1756-UM523F-EN-P - December 2006
48 Install the System
Install Modules in the
Second Redundant Chassis
1. For each module in the first redundant chassis, install an
identical module into the same slot of the second redundant
chassis.
2. Connect the CNB, ENBT, and EWEB modules to their respective
networks.
3. Connect one of these fiber optic cables to the 1757-SRM
modules:
• 1757-SRC1
• 1757-SRC3
• 1757-SRC10
• 1757-SRC50
• 1757-SRC100
2.
42800
L
5
5
S
R
M
C
N
B
1.
L
5
5
S
R
M
C
N
B
3.
E
N
B
T
E
N
B
T
IMPORTANT
• The modules in each redundant chassis must match each other
slot-by-slot.
• Set the rotary switches of the 1756-CNB/D/E or 1756-CNBR/D/E
modules for both redundant chassis to the same node address.
Publication 1756-UM523F-EN-P - December 2006
Install the System 49
Install the Remote Chassis
or Rails
You must install all I/O modules and additional types of
communication modules in remote chassis or on DIN rails. This
example shows a remote 1756 chassis. You can use any type of
chassis or device that you can connect to the ControlNet network.
As you install the chassis, follow these guidelines:
• Do not assign any device to the address of the CNB modules in
the redundant chassis plus one.
For example, if you set the rotary switches of the CNB modules
in the redundant chassis to node 11, no other device should use
node 12.
• Use a remote chassis for communication modules such as:
– 1756-ENET
– 1756-DHRIO
– 1756-MVI
– 1756-DNB
42197
L
5
5
S
R
M
C
N
B
C
N
B
D
N
B
L
5
5
S
R
M
C
N
B
DeviceNet Network
I/O Modules
Other ControlNet Node(s)
You must have at least 2 other nodes in addition to the redundant
chassis pair. See Lay Out the System on page 2.
E
N
B
T
E
N
B
T
IMPORTANT
If you connect the workstation to the network via a network
access port on a CNB module, use a CNB module in a remote
chassis. This lets a switchover occur after the failure of a
ControlNet tap of a primary chassis.
Publication 1756-UM523F-EN-P - December 2006
50 Install the System
Configure EtherNet/IP
Modules
To use an EtherNet/IP module, give it an IP address, subnet mask, and
gateway address.
Action Details
Before you begin. A. Perform these steps if you have not already:
• installed and connected both 1757-SRM modules.
• obtained the IP address, subnet mask, and gateway address for each EtherNet/IP
module. See Plan the EtherNet/IP Networks on page 12.
• Do you know how to configure an EtherNet/IP module in a nonredundant system?
• If no, then continue with step B.
• If yes, then go to step B.
B. Get this publication:
EtherNet/IP Modules in Logix5000 Control Systems, publication ENET-UM001
You will use that publication when you configure each module.
Configure the EtherNet/IP modules in the
first chassis.
A. Turn on the power to only one of the redundant chassis.
For example, if both chassis are on, turn off one of them.
B. Configure the EtherNet/IP module in the chassis that is on.
• Do you see the IP address on the front of the module?
• If no, then return to step B.
• If yes, then continue with step C.
C. Repeat step B for each EtherNet/IP module in this chassis.
Configure the EtherNet/IP modules in the
second chassis.
A. Turn off the chassis that you just configured.
B. Turn on the other chassis.
C. Configure the EtherNet/IP module in the chassis that is on.
• Do you see the IP address on the front of the module?
• If no, then return to step C.
• If yes, then continue with step C.
D. Repeat step C for each EtherNet/IP module in this chassis.
Publication 1756-UM523F-EN-P - December 2006
Install the System 51
Flash the Modules
To flash the modules, perform this procedure.
1. Turn on the power to one of the redundant chassis.
2. Wait for the 1757-SRM module to display PRIM.
3. Flash upgrade each module in the chassis with a compatible
revision of firmware.
• See the ControlFLASH Firmware Upgrade Kit User Manual,
publication 1756-6.5.6.
• To find the chassis in RSLinx software, locate the node
number or IP address on the front of the communication
module.
4. Turn off the power to the chassis.
5. Turn on the power to the second redundant chassis.
6. Wait for the 1757-SRM module to display PRIM.
7. Flash upgrade each module in the chassis with a compatible
revision of firmware. Use the same revisions that you used for
the first redundant chassis.
Check the Installation
Check the installation to make sure that your redundant chassis are
able to synchronize.
Complete this procedure after you:
• install the system.
• configure the communication modules.
• update firmware.
Redundancy Module
PRI COM OK
42801
PRIM
IMPORTANT
Only power up one chassis at a time.
Publication 1756-UM523F-EN-P - December 2006
52 Install the System
Actions
1. Turn on the chassis power to the partner (secondary) chassis.
2. Wait for the 1757-SRM module to complete its power-up cycle.
• The SRM module takes 1...3 minutes to power up.
• It may also take several minutes to synchronize the secondary
controller.
• Does 1 of the 1757-SRM modules show PRIM and the other
module show SYNC?
• Yes — Stop. The system is synchronized.
• No — There is a problem. The system is not synchronized.
Go to step 3.
3. Make sure that the Auto-Synchronization option of the SRMs is
set to Always. For help, see Chapter 4.
• Does 1 of the 1757-SRM modules show PRIM and the other
module show SYNC?
• Yes— Stop. The system is synchronized.
• No— Go to Troubleshoot a Failure to Synchronize on page
105.
Redundancy Module
PRI COM OK
42801
PRIM
Redundancy Module
PRI COM OK
SYNC
First Chassis
Turned On
Second Chassis
Turned On
Redundancy Module
PRI COM OK
PRIM
Redundancy Module
PRI COM OK
SYNC
53 Publication 1756-UM523F-EN-P - December 2006
Chapter
4
Configure the System Redundancy Module
Introduction
This chapter explains how to set or change the configuration of a
1757-SRM module. The SRM module controls the synchronization and
switchover of your redundancy system.
Use this chapter after you have installed your system to:
• change how the SRM supports your system.
• restart your system after redundant chassis regain power after a
power loss.
Open the SRM
Configuration Tool
To configure the system redundancy module, open the 1757-SRM
System Redundancy Module configuration tool.
Complete this procedure to:
• set the SRM clock.
• test a switchover.
• troubleshoot a system.
• store or load a project using nonvolatile memory.
• update firmware.
If Refer to this section On page
You just installed your system Open the SRM Configuration Tool 53
Check the Revision of Your SRM Configuration Tool 55
Check the Revision of Your SRM Configuration Tool 56
Set the SRM Clock 56
Test a Switchover 59
You want to change how the SRM
supports your system
Change Auto-Synchronization 61
Change Program Control 62
Both redundancy chassis lost power Set the SRM Clock 56
Publication 1756-UM523F-EN-P - December 2006
54 Configure the System Redundancy Module
Before You Begin
RSLinx software includes and automatically installs the 1757-SRM
System Redundancy Module configuration tool.
Actions
1. Start RSLinx software.
2. From the Communications menu, choose RSWho.
3. Double-click the network to open it.
4. Double-click the communication module in the primary chassis
to show the backplane.
5. Double-click the backplane to see its modules.
6. Right-click the 1757-SRM module and select Module
Configuration.
IMPORTANT
Check your revision of the SRM configuration tool when you
open it for the first time.
• The revision of tool that you get depends on your version of
RSLinx software.
• Some revisions of the SRM configuration tool are not
compatible with some revisions of a ControlLogix
Redundancy system.
The next section shows you how to see if your revision of the
SRM configuration tool is right for your redundancy system.
Workstation
Linx Gateways, Ethernet
My_Network
n, 1756 communication module
Backplane, 1756-Ax
xx, 1757-SRM
−
+
−
−
−
Publication 1756-UM523F-EN-P - December 2006
Configure the System Redundancy Module 55
What to Do Next
Check the Revision of Your
SRM Configuration Tool
Check the revision of your SRM configuration tool to make sure that
you are using the right revision of the SRM configuration tool for your
ControlLogix redundancy system.
Perform this procedure to:
• use the SRM configuration tool for the first time.
• connect to a different ControlLogix redundancy system for the
first time.
• update the firmware of a ControlLogix redundancy system.
Before You Begin
RSLinx software automatically installs the SRM configuration tool. Use
this table to see which revision of the tool that you get.
RSLinx Software Versions
IMPORTANT
Make sure that you check the revision of your SRM
configuration tool before you use it. Later revisions of the SRM
configuration tool are not compatible with earlier revisions of
ControlLogix redundancy systems. See Check the Revision of
Your SRM Configuration Tool on page 55.
IMPORTANT
Make sure that you check the revision of your SRM
configuration tool.
• Revision 2.6 is compatible only with revision 13.x or later
ControlLogix redundancy systems.
• You will cause the 1757-SRM module to fault if you use
revision 2.6 of the tool with an revision 11.x or earlier
redundancy systems.
Software Installed Tool
RSLinx software, version 2.42 SRM configuration tool revision 2.5
RSLinx software, version 2.43 SRM configuration tool revision 2.6
RSLinx software, version 2.52 SRM configuration tool revision 3.6
Publication 1756-UM523F-EN-P - December 2006
56 Configure the System Redundancy Module
Actions
Set the SRM Clock
To record significant events, set clock of the 1757-SRM module.
Perform this procedure:
• after system installation.
• after power loss to both chassis.
Action Details
1. Choose which revision to use. Do you connect your computer to ControlLogix redundancy systems revision 11.x or
earlier?
• Yes — Use revision 2.5 of the SRM Configuration Tool. Do not use revision 2.6.
• No — Use revision 2.6 of the SRM Configuration Tool.
Revision 2.6 is compatible only with revision 13.x or later ControlLogix redundancy
systems. You will cause the 1757-SRM module to fault if you use revision 2.6 of the tool
with an revision 11.x or earlier redundancy systems.
Keep in mind that some features are available only in revision 2.6 or later of the
configuration tool.
2. See which revision you have. A. Open the SRM configuration tool if you have not already done so.
B. Right-click the title bar of the configuration tool and choose About…
3. Change your revision If you need a different revision of the SRM configuration tool, see:
Knowledgebase document G92234770.
To access Rockwell Automation’s Knowledgebase, go to
http://support.rockwellautomation.com
Important: The SRM configuration tool lets you install only 1 revision on your computer at
the same time. To change the revision, remove the revision that you installed earlier.
Publication 1756-UM523F-EN-P - December 2006
Configure the System Redundancy Module 57
Before You Begin
The SRM clock records when significant events occur. Please note
these characteristics of the SRM clock:
• Only the primary SRM’s clock requires setting. The secondary
SRM’s clock synchronizes itself to the primary SRM’s clock.
• The SRM has no battery to keep its clock running. The clock
stops without SRM power.
• With power, the primary SRM synchronizes its clock to the most
recent event in its event log.
• The secondary SRM event log records when the secondary SRM
powered up. Look for WCT time change (> 1 second) event.
• An SRM with a firmware revision 3.37 or earlier does not log its
power-down time. If only one of the chassis powers down, use
the event log of the other chassis to see when it happened. Look
for The Partner RM Screamed event. See Interpret the SRM Event
Log on page 109.
Actions
Action Details
1. Open the SRM configuration tool for the
primary chassis.
A. Start RSLinx software.
B. From the Communications menu, choose RSWho.
C. Open the network branches until you find the 1757-SRM module in the primary chassis.
D. Right-click the SRM and choose Module Configuration.
Publication 1756-UM523F-EN-P - December 2006
58 Configure the System Redundancy Module
2. Set the clock. A. Click Configuration.
Action Details
B. Do you want to set the clock of the SRM to the clock of your computer?
C. Choose OK.
If Then
Yes Choose Apply Workstation Time and then Yes.
No 1. Change the date or time.
2. Choose Set and then Yes.
Publication 1756-UM523F-EN-P - December 2006
Configure the System Redundancy Module 59
Test a Switchover
Use RSLinx software to manually initiate a switchover.
Perform this procedure after you have synchronized your system and
want to test a switchover.
Before You Begin
The CNB modules in the new primary chassis show the
synchronization progress after a switchover. Typically, the modules
show this sequence.
Actions
PwNS ⇒ PwDS ⇒ PwQg ⇒ PwQS
primary with no
secondary
primary with
disqualified
secondary
primary with
synchronizing
(qualifying)
secondary
primary with
synchronized (qualified)
secondary
43130
Action Details
1. Open the SRM configuration tool for the
primary chassis.
A. Start RSLinx software.
B. From the Communications menu, choose RSWho.
C. Open the network branches until you find the 1757-SRM module in the primary chassis.
D. Right-click the SRM and choose Module Configuration.
Publication 1756-UM523F-EN-P - December 2006
60 Configure the System Redundancy Module
2. Start a switchover. A. Click Synchronization.
B. Choose Initiate Switchover and then choose Yes to continue.
3. Monitor the synchronization progress. A. Click Synchronization Status.
If the controller contains a large project, the system may spend some time
synchronizing the secondary controller.
B. If the Secondary Readiness remains Disqualified:
• Make sure the Auto-Synchronization option = Always.
• See Find the Cause of a Switchover or Disqualification on page 104.
Action Details
Publication 1756-UM523F-EN-P - December 2006
Configure the System Redundancy Module 61
Change
Auto-Synchronization
You can control when the 1757-SRM module tries to synchronize the
controllers.
Perform this procedure to:
• help synchronize the system.
• prevent the system from crossloading changes.
Actions
Action Details
1. Decide when you want the system to
synchronize.
Do you plan to manually disqualify a chassis so you can make changes?
• No — Choose Always
• Yes — Choose Conditional
2. Open the SRM configuration tool for the
primary chassis.
A. Start RSLinx software.
B. From the Communications menu, choose RSWho.
C. Open the branches of your network until you find the 1757-SRM module in the primary
chassis.
D. Right-click the SRM and choose Module Configuration.
If you choose Then
Conditional The SRM keeps the synchronization command that you give it. If
you:
• synchronize the secondary, the SRM always tries to keep the
controllers synchronized.
• disqualify the secondary, the SRM keeps the controller
unsynchronized (disqualified). It does not crossload changes.
Never The controllers will not try to synchronize, but you can still manually
synchronize the controllers.
Publication 1756-UM523F-EN-P - December 2006
62 Configure the System Redundancy Module
Change Program Control
You can direct the controller to send a message to the 1757-SRM
module or block the controller from doing so.
Perform this procedure when you:
• initially configure the SRM.
• decide to send the SRM a message from the controller.
Before You Begin
See page 91 for a list of messages that a controller can send to an SRM
module.
3. Set the auto-synchronization option. A. Click Configuration.
B. Select the Auto-Synchronization option.
C. Choose Apply and then Yes to continue.
D. Choose OK.
Action Details
Publication 1756-UM523F-EN-P - December 2006
Configure the System Redundancy Module 63
Actions
Action Details
1. Open the SRM configuration tool for the
primary chassis.
A. Start RSLinx software.
B. From the Communications menu, choose RSWho.
C. Open all the network branches to find the 1757-SRM module in the primary chassis.
D. Right-click the SRM and choose Module Configuration.
2. Set the program control option. A. Click Configuration.
B. Do you want to let a controller send a message to the SRM?
• Yes — Check the Enable User Program Control check box.
• No — Uncheck the Enable User Program Control check box.
C. Choose Apply and then Yes to continue.
D. Choose OK.
Publication 1756-UM523F-EN-P - December 2006
64 Configure the System Redundancy Module
Notes:
65 Publication 1756-UM523F-EN-P - December 2006
Chapter
5
Configure and Program the Controller
Introduction
This chapter explains how to configure and program the controller for
redundancy.
To configure and program a controller, complete these tasks.
Plan for Online Edits
Before editing online:
• decide if you want to keep test edits after a switchover.
• be aware that finalizing edits removes your original logic.
• decide how you want to set aside unused memory.
IMPORTANT
Create and maintain only one RSLogix 5000 project for the pair
of redundant controllers. When you download the project to the
primary controller, the project automatically crossloads to the
secondary controller.
Topic Page
Plan for Online Edits 65
Configure a Controller for Redundancy 68
Configure Communications 70
Estimate the Crossload Time of a Program 74
Minimize Scan Time 76
Maintain Data Integrity During a Switchover 82
Determine the Status of Your Redundant System 87
Condition Logic to Run After a Switchover 89
Send a Message to the SRM 91
Download the Project to the Primary Controller 95
Schedule a ControlNet Network 97
Set Task Watchdog Times 100
Publication 1756-UM523F-EN-P - December 2006
66 Configure and Program the Controller
Decide if You Want to Keep Test Edits after a Switchover
When you edit logic while online with the controller, the edits may
fault the controller and cause a switchover.
Test Edits
If test edits fault the primary controller, they will likely also fault the
secondary controller. To prevent faulting, any test edits are
deactivated (untested) during a switchover. As an option, you can
keep the edits active after a switchover.
Retention of Test Edits
Test Edit Options
Test Edits
If you want to Then
Prevent an incorrect online edit from
faulting both the primary and secondary
controller
Do not retain test edits (default setting).
Keep test edits active during a switchover
(at the risk of faulting both controllers)
Retain test edits.
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 67
Be Aware That Finalizing Edits Removes Your Original Logic
The controller removes the original logic when you finalize all edits in
a program. If your changes cause a major fault and a switchover, the
new primary controller also faults. That is because there is no original
logic to go back to. For example, the new primary controller cannot
untest the edits.
Decide How You Want to Set Aside Unused Memory
When the secondary controller receives crossload data, it first buffers
tag data in a quarantine section of memory. When it has all of the data
and knows it is valid, it moves the data into the main memory area.
That is why a redundant controller requires twice as much memory
for tags as a nonredundant controller.
Finalize all edits in program.
This happens even if you set the
controller to untest edits on a
switchover.
IMPORTANT
We recommend that you leave the Memory Usage slider in the
middle, default position.
Publication 1756-UM523F-EN-P - December 2006
68 Configure and Program the Controller
The controller sets up the quarantine area at the time of download:
• The controller divides its memory into two sections:
– tags, including a quarantine area
– logic
• The controller also divides its unused memory. It reserves a
specific amount for tags that you create while online. The rest
for logic.
You configure how to reserve unused memory between tags and
logic. You do this online in program mode.
Reservation of Unused Memory
Configure a Controller for
Redundancy
1. Open or create the RSLogix 5000 project.
2. On the Online toolbar, click the controller button.
Does General display the controller type?
• If no, go to step 3.
• If yes, go to step 6.
3. Click the Change Type button.
4. Select your controller.
5. Click OK.
6. Select Redundancy.
If you plan to Then Notes
While online, create roughly the same amount of new
tags and new logic
Leave the default setting.
While online, create a relatively large amount of new
tags but a much smaller amount of new logic
Drag to slider toward Tags. Avoid setting the slider all the way to Tags:
• You will be unable to perform online edits.
• OPC communications may error or fail.
While online, create a relatively large amount of new
logic but a much smaller amount of new tags
Drag to slider toward Logic. Avoid setting the slider all the way to Logic;
you will be unable to create tags while online.
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 69
7. Select Redundancy Enabled.
8. Click Advanced.
• We recommend that you not check this box. Leaving it
unchecked prevents an incorrect online edit from faulting
both the primary and secondary controller.
• If you want any test edits to remain active during a
switchover, then check this box. However, by doing so, you
run the risk of faulting both controllers.
• We recommend that you leave the Memory Usage slider in
the middle, the default position.
9. Click .
10. To close the Controller Properties dialog box, click .
7
8
Publication 1756-UM523F-EN-P - December 2006
70 Configure and Program the Controller
Configure Communications
A redundant system requires some specific configuration choices for
successful communications. Use this section to perform these
redundancy tasks:
• Configure I/O
• Configure produced tags
• Configure message (MSG) instructions
• Configure tags for an HMIConfigure I/O
For any outputs that require a bumpless switchover:
• put those outputs in the highest priority task.
• configure only that task at the highest priority.
Configure Produced Tags
If you want a controller in another chassis to consume a tag from the
redundant controller, use a comm format of None. In the I/O
configuration of the consuming controller, select a comm format of
None for the remote CNB module (the CNB that is physically in the
redundant chassis).
IMPORTANT
For each module in your system, make sure that the requested
packet interval (RPI) is less than or equal to 375 milliseconds. If
you use a larger RPI, the controller could lose its connection
with the module during a switchover. This could cause outputs
to change state.
IMPORTANT
During a switchover, the connection for tags that are consumed
from a redundant controller may time out.
• The data does not update.
• The logic acts on the last data that it received.
After the switchover, the connection reestablishes and the data
begins to update again.
IMPORTANT
If
If you set the remote CNB module to a comm format other than
None, you will receive module fault 16#000C in RSLogix5000.
This fault signifies a service request error due to an invalid
mode or status during a service request.
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 71
Produced Tag Configuration
C
N
B
L
5
5
M
C
N
B
S
R
M
Redundant Chassis
To the controller with the consumed tag, this
is the remote CNB module.
Remote Chassis
L
5
5
M
x
In the I/O configuration of this controller, select a communication
format of None for the remote CNB module.
Data
Produced Tag
Consumed Tag
Publication 1756-UM523F-EN-P - December 2006
72 Configure and Program the Controller
Configure Message (MSG) Instructions
Configured Message Instructions
If the MSG instruction isThen
From a redundant
controller
In a redundant controller, any MSG instruction that is in progress during a switchover experiences an error.
(The ER bit of the instruction turns on.) After the switchover, normal communication resumes.
To a redundant controller For any MSG instruction from a controller in another chassis to a redundant controller, cache the connection:
42977
Leave this box checked.
Path to the
Redundant
Controller.
Properties of the Message to the Redundant Controller
If the MSG instruction
originates from a
redundant controller
Then
During a switchover The message instructions status bits are updated asynchronously to the program scan. Consequently, you
cannot crossload your message instructions status bits to a secondary controller.
During a switchover, any active message instructions become inactive. When this occurs, you will need to
reinitialize the execution of your message instructions in the new primary controller.
During qualification The scrolling display changes from CMPT for compatible to Qfng for qualifying.
• If a configured message is cached, the primary controller automatically establishes a connection with no
errors.
• If a configured message is uncached or unconnected, the primary controller receives Error 1 Extended
Error 301, No Buffer Memory.
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 73
Configured Message Instructions, Continued
Configure Tags for an HMI
To monitor tags directly in the secondary controller (not typical),
monitor from no more than 3 devices through a CNB module.
Monitor tags in a secondary controller only via:
• RSLogix 5000 programming software.
• Any method that does not try to create OPC optimized packets.
Only a primary controller can create an OPC optimized packet.
If the message
instruction is
targeted to a
redundant controller
Then
During the erroring out
of a message
All backplane communications cease. This stoppage allows the redundant controller to receive the message
instruction required to perform a switchover or any diagnostics.
Important: If any of your messages are active during a switchover, you can expect one of these things to
happen:
• Cached and connected messages cause the message instruction to pause for 7.5 seconds because the
initiating controller has not received a response from the targeted controller. For cached messages, the
message instruction tries to execute three more times, each attempt followed by a pause of 7.5 seconds.
If, after 30 seconds pass, the targeted controller does not respond to the initiating controller, then the
switchover errors out with connected time out Error 1 Extended Error 203.
An example of a connected message would be CIP data table read-and-write messages after a
connection has been established.
• Uncached messages error out after 30 seconds if you have just initiated them because the intiating
controller never received a reply to the forward-open request. The error is Error 1F Extended Error 204,
an unconnected time out.
Examples of uncached messages would include CIP generic messages and messages captured during the
connection process.
During qualification Cached messages run with no errors. A connection has been established.
Connected, but uncached, messages or unconnected messages error out with Error 1 Extended Error 301, No
Buffer Memory.
Publication 1756-UM523F-EN-P - December 2006
74 Configure and Program the Controller
Estimate the Crossload
Time of a Program
You can estimate the crossload time of a program in a redundant
controller.
Perform this procedure to gauge the time a project spends
crossloading data.
Before You Begin
Crossload Time Estimations
IMPORTANT
By lowering the amount of time you spend crossloading data,
you can reduce your scan time.
Consideration Details
The controller crossloads data at the end of
every program.
The primary controller stops at the end of every program to crossload fresh data to the
secondary controller. This keeps the secondary controller up to date and ready to take over.
It also increases the scan time when compared to a nonredundant system.
The crossload time depends on how much
data changed.
The length of time for the crossload depends on the how much data the primary controller
has to crossload.
• The primary controller crossloads any tag to which an instruction wrote a value (even
the same value) since the last crossload.
• Crossloading also requires a small amount of overhead time to tell the secondary
controller which program the primary controller is executing.
In a redundant system, a ControlLogix5561,
5562, or 5563 controller is up to 30% faster
than a ControlLogix5555 controller.
The scan time improvement of ControlLogix5561, 5562, and 5563 controllers is less in a
redundant system is than in a nonredundant system.
• Even though the ControlLogix5561, 5562, and 5563 controllers execute logic faster,
they must still crossload data.
• Given the same project and redundant system, a ControlLogix5561, 5562, or 5563
controller is up to 30% faster than a ControlLogix5555 controller.
Execute Program in
Primary Controller
Start of Program
End of Program
Crossload Results to
Secondary Controller
Scan Time of Program
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 75
Actions
Action Details
1. Get the size of your crossload data. Use a Get System Value (GSV) instruction to read the REDUNDANCY object.
See Logix5000 Controllers General Instructions Reference Manual, publication
1756-RM003, for more information on the GSV and SSV instructions.
2. Estimate the crossload time. Which controller do you have?
• If ControlLogix5555, then crossload time = (0.0015 ms * DINTs) + 1 ms overhead
• If ControlLogix5561, then crossload time = (0.0013 ms * DINTs) + 1 ms overhead
• If ControlLogix5562, then crossload time = (0.0013 ms * DINTs) + 1 ms overhead
• If ControlLogix5563, then crossload time = (0.0013 ms * DINTs) + 1 ms overhead
where DINTs is the size of tag data to be crossloaded, measured in 4-byte words.
For this information Get this attribute Data
Ty pe
Description
• Size of the last crossload
• Size of the last crossload
if you had a secondary
chassis
LastDataTransfer
Size
DINT This attribute gives the size of data that was or would have been
crossloaded in the last scan.
• The size in DINTs (4-byte words).
• You must configure the controller for redundancy.
• You do not need a secondary chassis.
Is there a synchronized secondary chassis?
• Yes — This gives number of DINTs that was crossloaded in the last
scan.
• No — This gives number of DINTs that would have been crossloaded
in the last scan.
• Size of the biggest
crossload
• Size of the biggest
crossload if you had a
secondary chassis
MaxDataTransfer
Size
DINT This attribute gives the biggest size of the LastDataTransfer Size
attribute.
• The size in DINTs (4-byte words).
• You must configure the controller for redundancy.
• You do not need a secondary chassis.
• To reset this value, use an SSV instruction with a Source value of 0.
Is there a synchronized secondary chassis?
• Yes — This gives biggest number of DINTs that was crossloaded.
• No — This gives biggest number of DINTs that would have been
crossloaded.
Publication 1756-UM523F-EN-P - December 2006
76 Configure and Program the Controller
Minimize Scan Time
To minimize a project’s scan time, perform this procedure.
IMPORTANT
Do not try to get the scan time of a ControlLogix redundancy
project down below about 20 milliseconds. At very low scan
times, crossload data becomes a bigger performance burden.
This burden limits the minimum scan time.
Action Details
1. Use a few large programs instead of a lot
of small programs.
The controller stops at the end of every program to crossload data. So the more programs
that you have, the more the controller stops to crossload. And it often ends up
crossloading the same data many times.
To cut down the number of crossloads:
• Use only one or a few programs.
• Divide each program into whatever number of routines makes the most sense. A
routine does not cause a crossload.
• Use the main routine of each program to call the other routines of the program.
• If you want to use several tasks for different scan periods, put only one program in
each task. Remember that each program adds a crossload. So use only one or a few
tasks.
This is better Than this
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 77
2. Delete unused tags. This reduces the size of the tag database. A smaller database takes less time to crossload.
To delete unused tags:
A. Open one of the tags folders.
D. From the Edit menu, choose Select All.
E. Press the Delete key.
3. Use arrays and user-defined data types
instead of individual tags.
When you create a tag, the controller always sets aside at least 4 bytes (32 bits) of
memory. The controller does this even if the tag needs only 1 bit.
When you create an array or a user-defined data type, the controller packs smaller data
types into 4-byte (32-bit) words. This means the controller has less data to crossload.
Arrays and user-defined data types help you the most with BOOL tags. But also use them
for your SINT, INT, DINT, REAL, COUNTER, and TIMER tags.
Action Details
B. Click Edit Tags.
C. From the Show list, select Unused.
These 3 BOOL tags take 12 bytes total (3 tags x 4 bytes/tag = 12 bytes).
This array of 32 BOOLs takes only 4-bytes.
The controller crossloads all 12 bytes.
The controller crossloads only 4 bytes.
Publication 1756-UM523F-EN-P - December 2006
78 Configure and Program the Controller
4. If you have already created individual
tags, change them to aliases.
If you have already created individual tags, change them to aliases for elements of an
array. Your logic points to the aliases. The controller crossloads the base array.
5. Keep user-defined data types as compact
as possible.
Put like data types together when you lay out a user-defined data type.
• Put all the BOOLs together.
• Put all the SINTs together.
• Put all the INTs together.
Action Details
A. Create an array.
B. Change each individual tag to an alias for an element in the array.
C. Keep pointing your logic to the
individual tag names.
This is better
This data type takes 12 bytes. The BOOLs are together.
Than this
This data type takes 20 bytes. The BOOLs are spread out.
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 79
6. Keep code as compact as possible. Avoid checking the same conditions many times. Each instruction adds scan time to your
controller.
Action Details
This is better
This rung checks Bool_B and Bool_C only once each scan.
Than this
This rung checks Bool_B and Bool_C twice each scan. One or two instructions do not add much
scan time. But if you do this often, the extra instructions add up to a much longer scan time.
Publication 1756-UM523F-EN-P - December 2006
80 Configure and Program the Controller
7. Execute code only when you need it. The controller crossloads a tag anytime an instruction writes a value to the tag. This
happens even if the value stays the same.
• Many instructions write a value whenever they run. For example, instructions such as
OTL, OTU, and many instructions with Destination operands write a value each time
the rung-condition-in is true.
• Whenever an instruction writes a value, the controller marks the value for the next
crossload. This occurs even if the instruction wrote the same value that was previously
in the tag.
If you execute an instruction only when you need to, you reduce the amount of crossload
data. This reduces scan time. To limit the execution of an instruction:
• make a rung false when you do not need to execute its instructions.
• divide your logic into subroutines and call each subroutine only when needed.
• run noncritical code every few scans instead of every scan.
Action Details
This is better
Than this
The ADD instruction runs only when the controller gets new data (New_Data = on). And
Dest_Tag crossloads only when the ADD instruction produces a new value.
The ADD instruction writes the sum of Tag_1 + Tag_2 to Dest_Tag each time the rung
executes. The controller crossloads Dest_Tag every scan, even if Tag_1 and Tag_2 stay the
same.
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 81
8. Group your data by how often you need it. To update the secondary controller, the primary controller divides its memory into blocks of
256 bytes. Anytime an instruction writes a value, the primary controller crossloads the
entire block that contained the value. For example, if your logic writes only 1 BOOL value
to a block, the controller crossloads the entire block (256 bytes).
To minimize crossload time, group your data by how often you need it.
Suppose that you have some DINTs that you use only as constants to initialize your logic.
You have some BOOLs that you update every scan. And you have some REALs that you
update every second.
9. Use DINT tags instead of SINT or INT
tags
To keep your logic as efficient as possible, use the DINT data type instead of the SINT or
INT data types.
A ControlLogix controller usually works with 32-bit values (DINTs or REALs). If you use a
SINT or INT value:
• the controller usually changes a SINT or INT value to a DINT or REAL value before it
uses the value.
• if the destination is a SINT or INT tag, the controller usually changes the value back to
a SINT or INT value.
• you do not have to program the controller to change values to or from SINTs or INTs.
The controller does it automatically. But it takes extra execution time and memory.
Action Details
This is better
One user-defined data type for the DINTs.
The controller crossloads these 12 bytes
only once.
One user-defined data type for the
BOOLs. The controller crossloads these
4 bytes every scan.
One user-defined data type for the REALs.
The controller crossloads these 12 bytes
every second.
Than this
One user-defined data type for all the
data. The controller crossloads these
28 bytes every scan.
Publication 1756-UM523F-EN-P - December 2006
82 Configure and Program the Controller
Maintain Data Integrity
During a Switchover
The redundancy system guarantees a bumpless switchover for any
logic in the highest priority task. In some cases, a switchover may
make lower priority tasks repeat part of their scan. This has to do with
how data crossloads from the primary controller to the secondary
controller.
As the primary controller executes its logic, it updates the secondary
controller at the end of every program.
Switchover Overview
A. This data is sent to the secondary controller:
• Data from the program in the higher priority task.
• Data from the first part of the program in the lower priority
task.
B. Execution returns to the program in the lower priority task.
C. Data from the second part of the program in the lower priority
task is sent to the secondary controller.
When a switchover interrupts the execution of the primary controller,
the secondary controller reexecutes an interrupted program from the
beginning of the program.
Interruption by the Program
in a Higher Priority Task
Start of the Program in the Lower Priority
Task (for example, the continuous task)
Primary Controller
End of the Program in a
Higher Priority Task
A.
End of the Program in the Lower
Priority Task
C.
B.
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 83
Interrupted Switchover
A. This data is sent to the secondary controller:
• Data from the program in the higher priority task.
• Data from the first part of the program in the lower priority
task.
B. Execution returns to the program in the lower priority task.
C. The secondary controller:
• starts the scan at the beginning of the program that was in
progress in the primary controller during the switchover.
• uses the data from the last update.
In this example, the secondary controller starts the scan with an
image of the data as it was during the primary controller’s last
scan.
To prevent a scan from repeating after a switchover:
• look for array shift instructions.
• look for scan-dependent logic.
• take preventative actions
Switchover
occurs.
• This portion of the task is not executed
during this scan.
• Instructions executing at the time of the
switchover do not complete in this scan.
Primary Controller
Secondary Controller
Interruption by the program
in a higher priority task.
Start of the program in the lower priority
task (for example, the continuous task).
End of the program in a
higher priority task.
A.
B.
C.
Publication 1756-UM523F-EN-P - December 2006
84 Configure and Program the Controller
Look for Array Shift Instructions
These instructions might corrupt data during a switchover:
• BSL
• BSR
• FFU
Because these instructions shift data within an array, an interruption
by a higher priority task and a subsequent switchover leaves the data
with an incomplete shift.
• If a higher priority task interrupts one of these instructions, the
partially shifted array values are sent to the secondary controller.
• If a switchover occurs before the instruction completes its
execution, data remains only partially shifted.
• The secondary controller starts its execution at the beginning of
the program. When it reaches the instruction, it shifts the data
again.
Look for Scan-Dependent Logic
A rung that must read the output of another rung during the same
scan might miss a scan during a switchover.
Scan-Dependent Logic
A. The CTU instruction counts each scan.
B. The EQU instruction uses the count of each scan
(scan_count.ACC).
43065
A.
B.
C.
D.
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 85
C. If a higher priority task interrupts the logic, the value of
scan_count.ACC is sent to the secondary controller at the end of
the program in the higher priority task.
D. If a switchover occurs before the EQU instruction, the secondary
controller starts its execution at the beginning of the program.
The EQU instruction misses the last value of scan_count.ACC.
Take Preventative Actions
If logic seems susceptible to an upset during a switchover, either place
susceptible logic in the highest priority task, or, if the logic must
remain in a lower priority task, take one of these actions:
• Use UID and UIE Instruction Pairs.
• Buffer critical data.
Place Susceptible Logic in the Highest Priority Task
This prevents the controller from sending any data to the secondary
controller until the program finishes.
If a switchover occurs during the program, the secondary controller
repeats the scan using the same starting data.
Publication 1756-UM523F-EN-P - December 2006
86 Configure and Program the Controller
Use UID and UIE Instruction Pairs
Bound critical rungs with UID and UIE instruction pairs. This prevents
the higher priority task form interrupting the scan-dependent logic.
Buffer Critical Data
This example shows the use of a buffer together with a BSL
instruction.
1. The COP instruction moves the data into a buffer array.
2. The BSL instruction uses the data in the buffer. If a switchover
occurs, the source data (array tag) remains unaffected.
3. The CPS instruction updates array tag. Since higher priority
tasks cannot interrupt a CPS instruction, the instruction keeps
the integrity of the data.
1. 2. 3.
43065
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 87
Determine the Status of
Your Redundant System
You can write code that determines the status of your redundant
system.
Perform this procedure to:
• show system status on an HMI screen.
• condition code to execute based on system status.
• get diagnostic information to troubleshoot a system.
Actions
Use a Get System Value (GSV) instruction to read the attributes of the
REDUNDANCY object. See Appendix C for a list of attributes.
Example 1: Ladder Diagram
Example 2: Structured Text
//Get the ID of the primary chassis.
//That is always the chassis that runs the code.
//Store the ID in Chassis_ID_Now. Chassis_ID_Now is a DINT.
GSV(REDUNDANCY,,PhysicalChassisID,Chassis_ID_Now);
Get the ID of the primary chassis. The primary chassis always runs the code.
Store the ID in the Chassis_ID_Now tag. Chassis_ID_Now is a DINT.
comment
comment
comment
code
Publication 1756-UM523F-EN-P - December 2006
88 Configure and Program the Controller
Check Your Work
Use the Redundancy tab of the Controller Properties window to check
the code attributes. It does not show all the attributes, but it shows the
more common attributes.
Additional Resources
For more information, consult these sources.
• Appendix C
• Logix5000 Controllers General Instructions Reference Manual,
publication 1756-RM003
1. Download and run your project.
2. Open the Controller Properties window.
3. Click Redundancy.
4. Compare the Redundancy tab with your code.
In this example, the chassis ID A = 1.
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 89
Condition Logic to Run After
a Switchover
You can condition a section of your logic to run after a switchover.
Follow these examples to create logic in preparation for a possible
switchover.
Example 1: Ladder Diagram
Get the ID of the primary chassis. That is always the chassis that runs the code.
Store the ID in the Chassis_ID_Now tag.
Chassis_ID_Now — DINT.
If this is the first scan then
Set the last value of the chassis ID = the ID of this chassis.
Chassis_ID_Last — DINT.
If the chassis ID changes, a switchover happened.
If a switchover occurs, then
1. Turn on the Switchover_Happened bit.
2. Set the last value of the chassis ID = the ID of this chassis.
Switchover_Happened — BOOL.
Continued on next page
Publication 1756-UM523F-EN-P - December 2006
90 Configure and Program the Controller
Example 2: Structured Text
//Get the ID of the primary chassis.
//That is always the chassis that runs the code.
//Store the ID in Chassis_ID_Now.
//Chassis_ID_Now -- DINT.
GSV(REDUNDANCY,,PhysicalChassisID,Chassis_ID_Now);
//If this is the first scan
//Then set the last value of the chassis ID = the ID of this chassis
//Chassis_ID_Last -- DINT.
If S:FS then
Chassis_ID_Last := Chassis_ID_Now;
End_If;
//If the chassis ID changes, a switchover happened.
//If a switchover happens then
//Turn on the Switchover_Happened bit.
//Set the last value of the chassis ID = the ID of this chassis
//Switchover_Happened -- BOOL
If Switchover_Happened = on, then
1. Execute the instructions that you want to execute after a switchover.
2. Turn off the Switchover_Happened bit.
Put your instructions here.
comment
comment
comment
comment
code
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 91
If Chassis_ID_Now <> Chassis_ID_Last then
Switchover_Happened := 1;
Chassis_ID_Last := Chassis_ID_Now;
End_If;
//If Switchover_Happened = on
//Then
//Execute the instructions that you want to execute after a switchover.
//Turn off the Switchover_Happened bit.
If Switchover_Happened then
Put your statements here.
Switchover_Happened := 0;
End_If;
Send a Message to the
SRM
You can let your logic initiate actions in the SRM.
Perform this procedure to:
• Initiate a switchover.
• disqualify the secondary controller.
• synchronize the secondary controller.
• set the clock of the SRM module.
Publication 1756-UM523F-EN-P - December 2006
92 Configure and Program the Controller
Before You Begin
Before sending a message to an SRM, make sure that:
• the SRM is configured for program control.
• the message is unconnected.
Leave the Connected check
box clear (unchecked).
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 93
Actions
Use this table to configure a message to an SRM module.
Configuring a Message to an SRM
If you want to On this tab For this item Type or select
Initiate a switchover Configuration Message Type CIP Generic
Service Code 4e
Class name bf
Instance name 1
Attribute name Leave blank
Source INT tag with a value of 1
Num. Of Elements 2
Destination Leave blank
Communication Path 1, slot_number
where:
slot_number is the left-hand slot number of the
1757-SRM module.
Connected check box. Leave the Connected check box clear (unchecked). You can
send only unconnected messages to a 1757-SRM module.
Disqualify the secondary
controller
Configuration Message Type CIP Generic
Service Code 4d
Class name bf
Instance name 1
Attribute name Leave blank
Source INT tag with a value of 1
Num. Of Elements 2
Destination Leave blank
Communication Path 1, slot_number
where:
slot_number is the left-hand slot number of the
1757-SRM module.
Connected check box. Leave the Connected check box clear (unchecked). You can
send only unconnected messages to a 1757-SRM module.
Publication 1756-UM523F-EN-P - December 2006
94 Configure and Program the Controller
Synchronize the secondary
controller
Configuration Message Type CIP Generic
Service Code 4c
Class name bf
Instance name 1
Attribute name Leave blank
Source INT tag with a value of 1
Num. Of Elements 2
Destination Leave blank
Communication Path 1, slot_number
where:
slot_number is the left-hand slot number of the
1757-SRM module.
Connected check box. Leave the Connected check box clear (unchecked). You can
send only unconnected messages to a 1757-SRM module.
Set the clock of the SRM
module
Configuration Message Type CIP Generic
Service Code 10
Class name 8b
Instance name 1
Attribute name 1
Source WallClockTime[0]
where:
WallClockTime is a DINT[2] array that stores the
CurrentValue of the WALLCLOCKTIME object.
Num. Of Elements 8
Destination Leave blank
Communication Path 1, slot_number
where:
slot_number is the left-hand slot number of the
1757-SRM module.
Connected check box Leave the Connected check box clear (unchecked). You can
send only unconnected messages to a 1757-SRM module.
Configuring a Message to an SRM (Continued)
If you want to On this tab For this item Type or select
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 95
Download the Project to the
Primary Controller
You only have to download the project to the primary controller.
When the secondary controller is synchronized, the system
automatically crossloads the project to the secondary controller.
1. Open or create the RSLogix 5000 project for the controller.
2. From the File menu, choose Save.
3. From the Communications menu, choose Who Active.
Before proceeding to download your project, do not try to
match your project to your controller.
a. Right-click on your controller and select Properties.
IMPORTANT
If the secondary chassis becomes disqualified after you
download the project, make sure that you:
• configured the project for the right type of controller.
• enabled redundancy.
See Plan for Online Edits on page 65.
Publication 1756-UM523F-EN-P - December 2006
96 Configure and Program the Controller
b. Choose Advanced.
4. Browse to the controller in the primary chassis.
5. Select the controller and choose Download.
The Download diaglog opens.
6. Choose Download.
c. Leave unchecked Match
Project to Controller.
IMPORTANT
If you match your downloaded project to your controller, you tie
your project to your controller’s serial number. If you then
switch over to a controller in a different chassis, your project
will not match the new controller’s serial number, disabling the
controller functions originally specified under the Advanced tab
of Controller Properties
A. Open a branch in one of these ways:
• Double-click it.
• Click its + sign.
• Select it and press the
→ key.
B. Find the primary chassis. Its communication
module uses the address that you gave it.
Workstation
Linx Gateways, Ethernet
My_Network
n, 1756 communication module
Backplane, 1756-Ax
C. Find the controller.
xx, 1756 controller
−
+
−
−
−
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 97
Schedule a ControlNet
Network
To schedule a ControlNet network:
• schedule a new network.
• update the schedule of an existing network.
• check the keepers.
• save the project for each controller.
Schedule a New Network
To schedule a new network, perform this procedure.
1. Turn on the power to each chassis.
2. Start RSNetworx for ControlNet software.
3. From the File menu, choose New.
4. From the Network menu, choose Online.
5. Select your ControlNet network and choose OK.
6. Select the Edits Enabled check box.
7. From the Network menu, choose Properties.
8. From Network Parameters, type or select these parameters.
9. Choose OK.
IMPORTANT
Before you schedule a ControlNet network, turn on the power
to both redundant chassis. If you schedule a ControlNet
network while the secondary chassis is off, the keeper
signature of a CNB module may not match its partner, and the
secondary chassis will fail to synchronize.
In this box Specify
Network Update Time Repetitive time interval in which data is sent over the ControlNet network
Max Scheduled Address Greatest node number to use scheduled communications on the network
Max Unscheduled Address Greatest node number that you will use on the network
Media Redundancy Channels in use
Network Name Name for the network
Publication 1756-UM523F-EN-P - December 2006
98 Configure and Program the Controller
10. From the Network menu, choose Single Pass Browse.
11. From the File menu, choose Save.
12. Type a name for the file that stores the network configuration,
then choose Save.
13. Select the Optimize and rewrite Schedule for all Connections
button (default) and choose OK.
Update the Schedule of an Existing Network
To update the schedule of an existing network, perform this
procedure.
1. Turn on the power to each chassis.
2. Start RSNetworx for ControlNet software.
3. From the File menu, choose Open.
4. Select the file for the network and choose Open.
5. From the Network menu, choose Online.
6. Select the Edits Enabled check box.
7. From the Network menu, choose Properties.
8. From Network Parameters, update these parameters.
9. Choose OK.
10. From the Network menu, choose Single Pass Browse.
11. From the File menu, choose Save.
12. Select the Optimize and rewrite Schedule for all Connections
button and choose OK.
In this box Specify
Max Scheduled Address Greatest node number to use scheduled communications
on the network
Max Unscheduled Address Greatest node number to use on the network
Publication 1756-UM523F-EN-P - December 2006
Configure and Program the Controller 99
Check the Keepers
To check the keepers, perform this procedure.
On a ControlNet network, each keeper must:
• take over the keeper duties if the current keeper drops off the
network.
• use the same configuration regardless of which keeper first
comes online after a major network disturbance, such as a cable
short or system power cycle.
After you schedule your ControlNet networks:
1. Make sure the network shows all keeper capable nodes.
2. Make sure that each node is a valid keeper.
For more information, see Update a Keeper Signature on page 107.
Save the Project for Each Controller
To save the project for each controller, perform this procedure.
After your schedule your ControlNet networks, save the online project
of each controller. This lets you download a project in the future
without having to reschedule the networks.
For each controller (redundant and nonredundant) on a ControlNet
network:
1. Go online to the controller.
2. Save the project.
1. 2.
Keeper Capable Node Active Keeper Valid Keeper
Offline file
01 No Yes
02 Yes Yes
Publication 1756-UM523F-EN-P - December 2006
100 Configure and Program the Controller
Set Task Watchdog Times
To give a redundant controller longer watchdog times than a
nonredundant controller, perform this procedure.
• After a switchover, the secondary controller starts the scan at the
beginning of the program that was running in the primary
controller at the time of the switchover.
• The watchdog timer for the task that has the program, however,
is not reset.
• A major fault happens (type 6, code 1) if the watchdog timer has
too little time to completely rescan the program.
Action Details
1. Set the minimum watchdog time for a
task.
Use this formula to set the minimum watchdog time for a task:
Minimum watchdog time = (2 * maximum_scan_time) + 150 ms
where:
Maximum_scan_time is the maximum scan time for the entire task when the
secondary controller is synchronized.
2. Set the estimated watchdog time for a
task.
C. Type a watchdog time that is
more than the watchdog time
from step 1.
B. Click Configuration.
D. Choose OK.
Controller Primary
Tasks
MainTask
+
−
+
A. Right-click the task and choose Properties.
Loading...