Redundant Controller Switchover Time Optimization

What Switchover Time Really Means

Redundant controllers operate in a primary/standby pair. The primary executes the control logic and drives the I/O. The standby runs in hot-standby mode — it receives all input data and executes the same logic in parallel, but it does not drive outputs. When the primary fails, the standby takes over output driving. The interval between primary failure and the standby assuming full output control is the switchover time.

For Honeywell Experion PKS C300 controllers, the target switchover time is 10 to 30 milliseconds for safety functions and 50 to 100 ms for regulatory control. For Allen-Bradley ControlLogix 1756-L85E, the published switchover specification is less than 500 ms — but in practice, engineers frequently observe 200 ms to 2 seconds depending on project size, network loading, and heartbeat configuration.

A slow switchover causes momentary output freezes or “bumps.” On a flow control loop, a 200 ms output freeze produces a visible flow disturbance. On a turbine speed control loop, a 500 ms freeze during load rejection can trigger an overspeed trip.

Honeywell Experion PKS C300 Switchover Mechanism

The C300 controller pair communicates over a dedicated Redundant Data Interface (RDI) link — a 100 Mbps Ethernet connection on a separate physical network from the plant control network. The RDI carries three types of data: heartbeat signals, I/O state synchronization, and controller state flags. The C300 system backup battery ensures the standby controller maintains its synchronized state during brief power interruptions.

The heartbeat interval on the C300 RDI is configurable from 5 ms to 100 ms. A shorter interval detects primary failure faster but increases RDI network traffic. The default factory setting is 20 ms — meaning the standby detects a primary failure within 20 ms after the last received heartbeat. The actual switchover adds the synchronization verification time (typically 5 ms) and the output driver takeover time (typically 3 ms), yielding a total switchover of approximately 28 ms at default settings.

To optimize: reduce the heartbeat interval to 10 ms for safety-critical controllers. This yields a theoretical switchover of approximately 18 ms. Verify that the RDI cable length does not exceed the C300 specification of 100 meters between the primary and standby cabinets. Use Category 6 shielded twisted pair with the RDI link for best electromagnetic immunity. The C300 controller battery pack should be tested annually to ensure standby power availability during switchover events.

Allen-Bradley ControlLogix Redundancy Tuning

ControlLogix redundancy uses a dedicated System Redundancy Module (SRM) with fiber-optic link. The redundancy system synchronizes the primary and standby controllers at the task level. Every primary controller task completion triggers a synchronization event across the redundancy link. The 1756-RM2K redundancy module provides enhanced synchronization performance for large projects.

The key tuning parameter is the RPI (Requested Packet Interval) on the EtherNet/IP redundancy path. Default RPI is 20 ms. Reducing the RPI to 10 ms speeds up state synchronization between controllers. However, a smaller RPI increases CPU load on both controllers. Follow these optimization rules:

• Step 1: Limit the primary periodic task to one continuous task with a 50 ms period. Avoid multiple periodic tasks — each additional task creates a separate synchronization point on the redundancy link.
• Step 2: Set all digital I/O module RPI values to 50 ms. Faster RPI values (5 ms or 10 ms) on individual modules increase synchronization traffic without benefiting the overall switchover time.
• Step 3: Reduce the number of Produced/Consumed tags between controllers. Each consumed tag adds a CIP connection to the redundancy workload. Consolidate multi-tag data into UDT arrays to reduce connection count.
• Step 4: Monitor the controller task workload using Studio 5000 Task Monitor. If the primary controller task utilization exceeds 40%, the switchover time will degrade. Target a maximum of 30% task utilization under normal operating conditions to leave headroom for redundancy synchronization.

Five-Step Switchover Benchmarking Procedure

Measure the actual switchover time in the field using this procedure. Perform this test during a scheduled shutdown window — do not test switchover on a running process without operator awareness.

• Step 1: Connect an oscilloscope across a digital output channel. Configure the controller to drive the DO to a 50% duty cycle square wave at 1 Hz on both primary and standby controllers. The oscilloscope displays a continuous 1 Hz signal during normal operation.
• Step 2: Initiate a primary failure by disconnecting the primary controller power supply. The oscilloscope trace shows a flatline during the switchover gap — measure this gap duration with the oscilloscope cursor function.
• Step 3: For Honeywell C300, the expected gap is 15 to 30 ms. For ControlLogix 1756-L85E, the expected gap is 50 to 500 ms. If the measured gap exceeds the target by more than 20%, proceed to Step 4.
• Step 4: Check the redundancy link health indicators. On C300, verify the RDI link LEDs show solid green on both controllers. On ControlLogix, check the 1756-RM module LEDs — both Primary and Secondary LEDs must be solid green. A blinking RDI or SRM link indicates intermittent communication that degrades switchover time.
• Step 5: Restore primary power and verify bumpless transfer. The controller resumes driving outputs from the last synchronized state. Monitor analog outputs for any step change greater than 0.5% of span. A bump indicates incomplete state synchronization during the previous switchover.

Conclusion and Action Advice

Redundant controller switchover time is a design parameter that engineers frequently ignore after initial commissioning. On Honeywell Experion PKS C300, reduce the RDI heartbeat interval to 10 ms and verify the RDI cable length stays within 100 meters for safety-critical applications. On Allen-Bradley ControlLogix 1756-L85E, consolidate periodic tasks into a single 50 ms continuous task, standardize I/O RPI values to 50 ms, and keep controller task utilization below 30%.

Perform the oscilloscope benchmarking test after every firmware update or project modification — a code change that adds 5% to task utilization can increase switchover time by 30%. Document the measured switchover time in the commissioning report and set a standing maintenance work order to re-test annually during the plant turnaround. A controlled 20 ms switchover prevents the uncontrolled process disturbances that lead to unplanned shutdowns.

Author: Chen Hao is an industrial automation engineer with over 10 years of experience in PLC, DCS, and control systems.