System Description ____________________________________________________________________
RF-MCGARDPRO
Hubbell Power Systems, Inc.
–
RFL™
Products
July 1, 2022
©2022 Hubbell Incorporated
2-16
2.8
Controller Redundancy
2.8.1 Redundancy Controller Overview
The HPS/RFL GARD Pro system Controller Module offers a redundant operation mode when
used in a 6U chassis. When equipped with two Controller Modules, a GARD system can disable
a faulty module and transfer its functionality to the standby unit.
The redundant-mode control elements are effectively independent of basic GARD functions and
features. Redundancy subsystems monitor the condition of the module and take part in
determining which module is active.
When only a single Controller is present in a GARD chassis, the redundancy subsystem continues
monitoring, however, it has no effect on the active state of the Controller. A single module cannot
be made inactive.
CAUTION
System Firmware version 2.1.0 or greater is required for Redundancy. Both controllers must
have matching system firmware versions for correct operation.
2.8.2 Rules of Operation
Two GARD Controllers present in the chassis in their dedicated slots facilitate the redundant
mode of operation. Only 6U chassis offer two controller slots. Redundant mode is not possible
with a 3U chassis.
When Both Controller slots are in use, Slot 11 has priority, while Slot 10 the standby (Redundant)
Controller has a short delay allowing the Main controller to become active first. An “ACTIVE”
module drives or controls the traffic within the chassis and configures other submodules. An
“INACTIVE” module does not output any signals onto mid-plane buses.
The basic rules governing swapping between the active and inactive state were designed to be as
simple as possible and to minimize disturbances to the system and prevent swapping into a faulty
or non-existent module.
•
A module cannot decide by itself to become active. It can become active only if the
other Controller fails or is disabled.
•
A failed module does not necessary become inactive. A swap to the other module may
happen only if the other module exists and is itself not in fault. A system with
Redundancy will block a swap into a faulty module.
•
There are no levels or degrees of fault conditions within a Controller module. A faulty,
disabled or non-existent module is treated the same way, since its state is not
trustworthy anymore.