3.3 STANDBY-ACTIVE SWITCH OVER
The switch over is the situation that leads to a swapping of the role that the controllers play in the
redundant system.
The Standby controller is responsible for the decision to switch over as a final result of the
evaluation of the local and remote diagnostics or of parcel error count conditions.
This is how the switch over takes place:
1. The Standby controller notifies to the active controller the need to switch over. The notification
is sent over serial line and, alternatively over the Lonworks.
2. The Active controller sets its internal redundancy role to Standby, responds with an
acknowledge, issues an alarm of occurred switch over and restarts.
3. The Standby controller sets its internal redundancy role to Active and resynchronizes the
scanner network.
4. No requests are sent by the Standby controller to the scanners. The new initialization will
inform the scanners about which controller is active and where it has to take the encoder signal
from.
3.3.1 Validation of the Diagnostic Information
The validation of the role of the active controller is cyclically performed by the Standby controller,
based on the local and remote presence sensor and encoder diagnostics comparison. A failure in
the validation procedure leads to the switch over.
Because of the difficulty of determining in a simple way the conditions of “best encoder value” and
“best presence sensor value”, the validation implemented at this stage of the project takes into
account the following diagnostic events:
Diagnostic
Error Number
Meaning
[130]
Encoder Failure Timeout: no encoder signal for more than the programmed
timeout.
[131]
Presence Sensor Failure: presence sensor failure
[132]
No Phase Timeout: no reading phase for more than the programmed timeout.
[135]
Encoder Failure: no encoder signal after two consecutive presence sensor events.
Using the above data allows the detection of the failure of the resources and, based on this
information it is possible to state the following:
•
The Standby controller is able to validate the active controller’s presence sensor if the errors
131 and 132 are not present
•
The Standby controller is able to validate the active controller’s encoder if the errors 130 and
135 are not present
