Redundancy

Redundant control system

You can increase the reliability of your control system by safeguarding your PLC with a redundant PLC. The redundant PLC is able to take over the application execution at runtime. This can prevent system failures, for example.

The illustration shows the structure of a redundant control system. The application runs simultaneously on two PLCs: one active PLC (1) and the second PLC in standby mode (2). The PLC in standby mode reads the inputs of the connected fieldbus system (EtherCAT in the illustration) and synchronizes with the active PLC via the redundancy link (3). This allows the standby PLC to immediately become active in the case of a malfunction and to take over the control of the fieldbuses (4) without interruption.

The redundancy interconnection (3) is implemented with TCP and UDP, but can be replaced by a vendor-specific component.

Moreover, you can use visualizations with the redundant control system when they will run as CODESYS WebVisu in a browser. The visualization clients will continue to run almost seamlessly in the event of a switchover.

Basic information about functionality

The application programmer downloads the application to the first PLC and creates a boot application.

The second PLC is synchronized when booted and receives the boot application.

The boot application is loaded and initialized and then it is ready to execute the first task cycle. All data from the registered memory areas (all IEC data) is transferred to the second PLC. This means that redundancy is effective and the application task is executed synchronously on both PLCs. The synchronization of the task execution is implemented by messages which are sent via the redundancy interconnection. The messages are sent before and after the IEC task is executed.

There is no preferred active PLC. The operating mode is determined by the boot sequence. The first PLC to boot sends a corresponding message via the redundancy interconnection. If it does not receive a response, then it loads the boot application and runs in standalone mode.

If a message from the active PLC is not received by the standby PLC within the configured time, then the standby PLC assumes that the active PLC is no longer working. As a result, the standby PLC switches to standalone mode and now controls the fieldbus I/Os. The active PLC also switches to standalone mode if it has not received a message from the standby PLC within the configured time.

If the first PLC is replaced and restarted, then it synchronizes with the other PLC currently in standalone mode as described above and therefore goes into standby mode.

A standby PLC can be switched to simulation mode. Redundancy is then not activated, but the fieldbus remains deactivated as in standby mode. The active PLC switches to stand-alone mode. Simulation mode can be ended by resynchronizing or restarting the PLC. The PLC then switches back to standby mode, unless errors occur during synchronization or restart.

If errors occur during the update of the boot application or the registered memory areas, or during the redundancy cycle, the PLC is switched to error mode. It must then be resynchronized or restarted.