Redundant server pair

The same project is loaded on two computers and Live is opened on both. Live tells from the Windows computer name whether it is Server 1 or Server 2. The two Live instances watch each other over the redundancy port.

• The master communicates with the PLCs and runs alarms, the archive, tasks, scripts and reports.
• The standby shows the screens with the values of the master. Operators can work on the standby too: tag writes, alarm acknowledgment, shelving and comments are forwarded to the master.
• If the master does not respond, the standby becomes master and starts PLC communication. A failed master that comes back joins as standby; it does not take the master role back by itself.

If the network between the two computers fails, each may believe the other has failed. The arbiter prevents this. The master writes a counter, increased every second, to every PLC that has an arbiter address. When the standby cannot reach the master, it looks at these counters: if a counter is still increasing, the master is alive and the standby does not take over; if not, it becomes master.

• The arbiter address must be a writable Int that is not used for anything else in the PLC program, for example DB1.DBW0 or 40100.
• Areas that cannot be written, such as inputs, outputs and input registers, are not accepted.
• Defining it on at least two PLCs is recommended: if one is off, the other decides.
• The standby reads only the arbiter addresses from the PLCs.

• At startup Live asks the other server. If the other one is master, it becomes standby. If both start together, the default master becomes master.
• If the standby gets no response from the master for the timeout, it looks at the arbiters and takes over if needed.
• If both servers are seen as master, the one that became master later steps back.
• Manual handover: on the master, the Redundant server section of the system menu has a Hand over master role… button; a login is required.

When the role changes, the page reloads. Internal tag values and alarm states move to the new master; alarms are not logged as incoming a second time. The window title ends with “Master” or “Standby”.

• Values come from the image of the master. If no data comes from the master, the Redundant server section of the system menu warns that the values are not up to date.
• Alarm detection, archive logging, scheduled tasks, scripts and report records run only on the master. On the standby, an event function that runs a script does not run and gives a notification.
• Alarm, event, archive and report logs are synchronized from the master every few seconds; when the standby reconnects, the chosen number of days of history is taken too.
• Browser viewers switch to the other server if Browser / TV failover is on, and log in again.

• A redundant pair consists of two servers. There are no separate client stations (server / client architecture); each Live runs its own screens.
• No firewall rule is added automatically for the redundancy port.
• The connection between the two Live instances is plain HTTP and is accepted only from private network addresses and with the pairing key. Keep the two servers on a closed plant network.
• Log lines written on the standby while the master cannot be reached stay local. Additional applications start on the standby too.
• Redundancy was tested with automated tests and with two Live instances running on the same computer. Do not commission it before trying it on two separate computers with a real PLC arbiter.