Water plants, power systems and refineries may need controller redundancy to reduce interruptions after a CPU failure. Hot Standby runs two identical M580 CPUs: a primary in control and a standby receiving synchronized application data over the dedicated link. If the primary fails, the standby can take over using that synchronized state. The simulation shows the handover; an actual installation must be configured and tested for the process it controls.
CPU A controls the simulated tank as primary. CPU B receives the application state shown here through the synchronization link. As the tank fills, the active controller regulates the level. Select 💥 Fail the primary to make the standby take control and inspect the logged switchover. The smooth level trace is the example's behaviour, not a guarantee of zero interruption on installed equipment.
The standby uses synced memory to continue the application from the transferred state instead of treating the handover as a fresh process start. Check which data the configured system transfers and how the application responds. In the simulation, repairing the failed CPU lets it return as standby for the next handover.
🔄 State sync every scan. Application data is transferred over the dedicated synchronization link. The timing and transferred data must match the requirements of the configured system; do not assume that every memory location is continuously mirrored.
👑 One commander at a time. The primary controls the outputs while the standby remains ready for promotion. The configured redundancy system coordinates that ownership during switchover. Verify the actual handover and the response of connected equipment during acceptance testing.
🔌 Shared RIO. Both controllers connect to the configured remote I/O system (Track 07). That shared arrangement lets the new primary control the installed I/O without physically moving the wiring to the other CPU.
🪪 Identical apps. The applications and system configuration must meet the Hot Standby compatibility requirements. Follow the prescribed download and synchronization procedure, then check the pair's status rather than assuming a download automatically leaves it ready for redundancy.
The standby needs to continue the process using the relevant timer, counter and sequence state after a primary failure. What provides that state in the redundant pair?