Softing FG-200 HSE/FF, User Manual

Page: 64 / 82

FG-200 HSE/FF Modbus - User Manual
64
Version EN-112021-1.30.3
9.2 Redundancy
9.2.1 Redundancy behavior
The following table provides detailed information on the redundancy behavior. This may be useful to get a
correct understanding of what fault conditions can be covered and how the system recovers from those
fault conditions.
In any case, the fully redundant state is obtained again when the secondary device indicates
"operational" (RUN-LED flashing) and its H1 live lists are complete. In highly populated, tightly configured
H1 links it may take several minutes to acquire the live lists. Before the live lists are completed, redundancy
switching is possible but client server connections can only be established to H1 devices which are in the
live list.
Any further error that occurs before the fully redundant state is reached may cause the system to fail.
9.2.1.1 Primary device failure (1)
Primary device failure due to permanent or transient hardware or software fault (1):
Fault detection
Device fails completely or software watchdog expires or hardware watchdog
expires or exception occurs or failure in H1 interface detected.
Fault treatment
Primary role actively transferred to or taken by redundant system
Effect
Redundancy switch-over. System degrades to non–redundant system.
Repair measure
Transient fault: Automatic reboot
Permanent fault: replace device
Secondary service will reboot and receive configuration data from primary
device.
9.2.1.2 Ethernet cable broken (2)
Ethernet cable broken between primary device and Ethernet hub/switch (2)
Fault detection
Bad link status of Ethernet port detected. Detection time less than 500 ms.
Fault treatment
Primary role actively transferred to redundant device.
Effect
Redundancy switch-over. System degrades to non-redundant system.
Repair measure
Repair or reconnect Ethernet cable.
Secondary device will reboot and receive configuration data from primary device.
9.2.1.3 H1 cable broken (3)
H1 cable broken between primary device and H1 network (3)
Fault detection
Empty live list detected on one H1 port or primary device while secondary device
still has non-empty live list. Due to the H1 protocol it may take some seconds.
Until the live list becomes empty. Detection occurs only if in primary device and
secondary device the number of active H1 devices in the live list has exceeded the
threshold of one.
Fault treatment
Primary role actively transferred to redundant device, so that access to H1 is
possible again.