Modicon M580 Hot Standby Programming Rules

At a Glance

For Modicon M580 Hot Standby applications, some of the programming functionality you may have used does not apply to redundant operations. This section summarizes some of the code features and programming rules of a Modicon M580 Hot Standby application.

Error Correcting Code (ECC) Feature

M580 Hot Standby CPUs with firmware version 2.50 and higher include an error correcting code (ECC) feature. ECC enhances reliability by reducing the likelihood of memory random access errors, when a Hot Standby CPU accesses its internal memory, as part of a memory transfer event. The ECC function is enabled by default.

When ECC is enabled, it may impact the MAST cycle time of Hot Standby M580 CPU applications. This can be the case where a relatively small amount of code is transferred, but a large amount of data is transferred. If the impact on MAST cycle time is not suitable for your application, you can:

Reduce the amount of exchanged data from the primary to the standby CPU.
For a non-safety CPU application, disable the ECC feature using %SW150.

Changing Declared Variables

Do not overwrite the initial values for declared variables using the save operation invoked using the system bit %S94. These changes to declared variable values are not part of the database transfer, and can lead to unintended consequences at switchover.

CAUTION

RISK OF UNINTENDED OPERATION

Using the save operation, that is invoked using system bit %S94, on the primary CPU does not also apply to the standby CPU.

If a swap or switchover occurs after a CCOTF has been performed on the primary CPU, and the application has not been transferred to the standby CPU, then the behavior of the application is unpredictable.

Failure to follow these instructions can result in injury or equipment damage.

Section executed on Standby Restrictions

The following restrictions apply to sections executed on the Standby PLC, first section, or all sections depending on the configuration:

Derived Function Blocks (DFB) may not be executed on Standby PLC sections.
R_TRIG, F_TRIG, TRIGGER, TON, TOF, TP functions blocks may not be executed on Standby PLC sections.
Asynchronous communication procedures may not be executed on Standby PLC sections.
Asynchronous communication function blocks may not be executed on Standby PLC sections.

Asynchronous Communication Procedures

During a switchover event, asynchronous communication procedures: READ_VAR, WRITE_VAR, DATA_EXCH, INPUT_CHAR, INPUT_BYTE, PRINT_CHAR, do not automatically resume operation on the new Primary PLC without special care.

The following procedure should be used to allow asynchronous communication EFs to automatically resume operation after a switchover:

Program your application so that all EFs management parameters are not exchanged with Standby PLC. To do this, de-select the Exchange on STBY attribute for the management parameter.
Initialize the Length parameter each time the function is called.
Set the Timeout parameter accordingly to your application:
- If the communication function is send through the CPU, the typical timeout value is 500 ms.
- If the communication function is send through a NOC module, the typical timeout value is 2 s.

NOTE: If for some reason you are unable to follow this procedure, and a switchover renders your communication function inoperative, write your application program so that it sets the function activity bit to 0 before restarting the function in the new Primary CPU.

Asynchronous Communication Function Blocks

During a switchover event, asynchronous communication function blocks, which use internal management parameters: GET_TS_EVT_M, READ_DDT, READ_PARAM_MX, READ_STS_MX, RESTORE_PARAM_MX, SAVE_PARAM_MX, WRITE_CMD_MX, WRITE_PARAM_MX, MBP_MSTR, READ_SDO, WRITE_SDO, ETH_PORT_CTRL, PWS_DIAG, PWS_CMD, L9_MSTR, do not automatically resume operation on the new Primary PLC without special care.

The following procedure should be used to allow asynchronous communication EFBs to automatically resume operation after a switchover:

Program your application so that all EFBs instances are not exchanged with Standby PLC. To do this, de-select the Exchange on STBY attribute for the EFB instance.

Other Functions

While the use of the functions listed above is restricted, you are advised to use care even when employing permitted functions that are capable of writing to memory areas that are not part of the Hot Standby database transfer, such as Data Storage function blocks for instance.

Debugging

Debugging your Hot Standby application program is now a two-stage process:

First, you debug the application on a single Hot Standby PLC as if it was a standalone application. This allows you to use all of the powerful debugging features available in Control Expert, such as watchpoints, and so on.
Next, you debug your application when it has been uploaded to two Hot Standby PLCs in a working redundant system, but in a non-production environment. On this platform, you evaluate performance specific to Hot Standby redundancy. Only a subset of Control Expert debug features can be used during this stage.

NOTE: See M580 Hot Standby Diagnostics for further details on debugging your Hot Standby application program.

PME UCM 0202 Universal Communication Module

Do not use a PME UCM 0202 Universal Communication Module in a Drop of a Modicon M580 Hot Standby configuration.