Master redundancy

To set up a redundant control system, a DP master device can be started in redundancy mode. In redundancy mode, a DP master device only "listens" on the bus, i.e. is not active on the bus.

For a redundant control system, two master devices with the same configuration are attached to the PROFIBUS. These two master devices are the primary master device and the redundancy master device. The primary master device normally handles the communication, the redundancy master device only listens on the bus, but does not transmit.

The redundancy mode ("Bus Parameter" dialog) is set to inactive for the primary master device. The settings "SetPrm-Unlock before DP-Start-Up" and "SetPrm-Unlock at DP-Shutdown" in the "Start-Up/Fault Settings" dialog should be deactivated if the primary master device is to be started or stopped without affecting the DP slave devices, i.e. without changing the outputs. The watchdog of the primary master device must be set such that the primary master device logs off the bus if its PC crashes.

The Redundancy-Mode ("Bus Parameter" dialog) is set to active for the redundancy master device. The settings "SetPrm-Unlock before DP-Start-Up" and "SetPrm-Unlock at DP-Shutdown" in the "Start-Up/Fault Settings" dialog should be deactivated if the primary master device is to be started or stopped without affecting the DP slave devices, i.e. without changing the outputs.

In redundancy mode, the ReceivedTelegram counter increments each time a valid PROFIBUS telegram has been received, and the ReceivedTelegramFromPrimaryMaster counter increments each time a valid PROFIBUS telegram has been received from the primary master device. In redundancy mode, the ClaimTokenTimeout counter increments each time the redundancy master device detects a timeout on the bus after it would normally take over the bus activity, i.e. if the redundancy mode were deactivated.

The application, a PLC task or another program, is responsible for diagnosing the failure of the primary master device. The failure of the primary master device can be recognized, for example, by the fact that the ReceivedTelegram counter or the ReceivedTelegramFromPrimaryMaster counter no longer increment, that the ClaimTokenTimeout counter increments or that the application-specific monitoring of both PCs triggers an error.

The redundancy master device does not update process data as long as it only listens on the bus. When it is started, the DpState of the boxes should be evaluated. If the DpState has the value zero, then the process data are current.

The StartRedundancyMaster flag can be used to start or stop the redundancy master device. The redundancy master device becomes active on the bus when the StartRedundancyMaster flag is set. As soon as the StartRedundancyMaster flag is reset, the redundancy master device terminates its bus activity the next time a token is sent without terminating its connection to the slave devices.

Starting the redundancy master device takes about ten times as long as the time set for "Min-Slave-Int." ("Bus Parameter" dialog). Once the StartRedundancyMaster flag has been reset, the next token is sent at the end of the DP cycle, but no later than after the "Estimated DP-Cycle" ("EL6731" dialog). Regardless of the setting "SetPrm-Unlock at DP-Shutdown" ("Start-up/Fault Settings" dialog), the redundancy master device does not terminate its connection to the slave devices once the StartRedundancyMaster flag has been reset.

If the DP watchdogs of the DP slave devices are set, you must ensure that the DP watchdog time is longer than the monitoring time of the primary master device of the application plus the startup time of the redundancy master device, if the transfer of the DP slave devices by the redundancy master device is to take place non-reactively, i.e. without changing the outputs.