Conditions That Result In Switchover; Conditions That Do Not Result In A Switchover - Honeywell C300 User Manual

8. C300 Redundancy operation
8.6. Switchover

Conditions that result in switchover

The Secondary controller must be in either the Synchronized state or Standby state for a
switchover to occur. The following conditions result in a switchover:

Execution of a Switchover command (from Primary or Secondary Platform FB).

Loss of both FTE links to Primary controller.

Loss of both IOL channels connected to Primary C300 I/O Link X,
where:

X is the I/O Link number (that is, equally applies to either I/O Link).

The IOLINK Type for this I/O Link has a value other than NONE.

There is at least one configured IOM communicating on the I/O Link.
ATTENTION
Controller redundancy protects against all single faults and some dual faults.
The Primary C300 Dual IOL Cable Disconnect switchover trigger is a dual
fault that cannot be detected until after some control has been back-initialized
with failsafe data. Although this dual fault affects control, switchover provides
automatic recovery that does not require the operator to diagnose how to
deal with a primary that has a complete loss of IOM view.

Loss of input power to Primary controller

Primary controller failure

Removal of the powered Primary controller module from its IOTA

In the case of an unsynchronized redundant controller pair with both controllers
experiencing a dual-FTE cable disconnect. The FTE reconnect to the secondary
controller results in initial-sync followed by immediate switchover.

Conditions that do not result in a switchover

These conditions do not result in a switchover:

Loss of redundancy cable (private path) between Primary and Secondary controllers.

Loss of one or both FTE links to Secondary controller.

Loss of one or both IOL channels connected to Secondary C300 I/O LINK.

Loss of input power to Secondary controller.
218 Series 8 C300 Controller User's Guide
Honeywell
R500
April 2017