ABB CP435T 1SBP260193R1001 touch screen
7 Redundancy
In the case of redundancy a bumpless toggle is achieved between the active FieldController (Pri mary)and a passive FieldController (Secondary), so that :
• in the case of CPU failure the outputs of the I/O components are maintained,
• the internal states (component data, variable values) are maintained,
• Configuration and working data are automatically adjusted between the active and passive
FieldController.
7.1 Network configuration in the hardware structure
A FieldController possesses a Resource ID and an IP address. In the case of redundant Field Controllers an IP address is specified for each of the two FieldControllers.
Configuration → System → Hardware structure → Network
Which of the CPU modules is Primary and which is Secondary is not defined by IP address
1 and IP address 2.
The coding switch on the Ethernet module used for the redundancy link must be set to IP
address 15 (switch position F). See Mounting and Installation Instructions. This module
must always be installed in slot E2.
7.2 Synchronization
The active FieldController (Primary) automatically ensures that the passive FieldController (Sec ondary) can take over in the event of redundancy. The adjustment of operating system, user pro grams and redundancy data necessary for this is performed via a redundancy connection, the re dundancy link. The connection is produced at the front of FieldController and is implemented via
an Ethernet cable, optionally 10BASE2 (BNC), AUI, or twisted pair cable (TP) .
When the FieldController is bootstrapped one of the two FieldControllers automatically becomes
the Primary. The second FieldController recognizes a Primary on the station bus and reports to
the Primary as Secondary.
A newly plugged-in FieldController recognizes automatically that another FieldController is
already active on the station bus and moves automatically into the passive status.
In the adjustment between the active FieldController and a passive FieldController, a connection
is established via the redundancy link. The user program is transmitted from the Primary to the
CPU.
The Secondary performs a cold start with these data and then logs on at the Primary. The current
process data are then transmitted to the Secondary. After successful transmission, both Field Controllers move to “sync“ status. From now on, the Secondary is ready for a bumpless redun dancy toggle. The relevant process data are adjusted cyclically.
The synchronization runs in parallel with the processing of the applications programs in the Field Controller.
Depending on the Boot priority of the Secondary, side-effects can be avoided when synchronizing
tasks. The higher the Boot priority of the Secondary compared to the processing priority of the
task (51 – 99), the faster the FieldController reaches Sync status.
See also Engineering Manual, System Configuration, Project Tree, Process Station.

7.3 Redundancy toggle
If any of the following occur at the Primary, a redundancy toggle is initiated deliberately between
Primary and Secondary:
• the Prim/Sec toggle switch of the FieldController is actuated,
• the Prim/Sec button of the resource is actuated in commissioning mode,
• the reset switch is actuated > 5 s, resulting in a cold start of the Primary,
• the system function „Force redundancy toggle“ is executed.
7.4 Redundancy criteria
If the following have been established by the self-test diagnosis, a redundancy toggle between
Primary and Secondary is forced:
a different module insertion has been detected in the two FieldControllers,
a module fault has occurred,
an equipment fault has been detected on the fieldbus module,
• the watchdog has responded: a hardware fault has occurred on the FieldController,
• a power fail of the power supply is reported,
• a network fault (Ethernet) has occurred,
• a “fatal software error” has occurred.