1.538 Protection-Switch-N-To-1

The Protection-Switch-N-To-1 logical device provides a completely software based solution for a N:1 redundancy switch. The device is preconfigured to handle 2 to 12 operative chains, but it may quite simply be extended to serve more chains. The block diagram below shows a typical application scenario for the Protection-Switch-N-To-1 device. Three operative transmit chains are backed up by one spare chain. A 'ladder' of waveguide switches at the chains' output controls which RF signal gets routed to the antenna.

During normal operation the waveguide switches are set as shown in the diagram. The output of the operative chains goes to the antenna, the output of the spare chain is routed to a dummy load. The protection switch watches (mirrors in memory) the key settings of all devices in the operative chains. In case of a fault in an operative chain, the spare chain gets gets switched in place of the faults chain and the spare devices are commanded to the settings which have been mirrored for the faulty chain.

The protection switch operates in 'single shot mode'. It switches once if a fault was detected, but never switches back automatically. After a switch-over to the spare chain, the operator has to check the equipment in the faulty chain. After everything is OK again, the signal can be switched back to the operative chain at a suitable time. Only now the transmission is backed up again.

The behaviour of the Protection-Switch-N-To-1 device is widely configurable, however to keep the number of configuration settings manageable, the device demands some rules in the overall structure and the device naming. These rules are:

• The devices which are managed by the protection switch must follow certain naming conventions. In the protection switch device setup dialog name prefixes for the device in each chain can be defined, the protection switch completes these names by the chain index on it's own. Alternatively the device names may be defined explicitly as comma separated lists.
• If using waveguide switches the the chain outputs, the switches must be connected to a ladder as shown in the block diagram above. All switches in the ladder must be oriented in the same way. The naming rules apply for the switches as well.
• The RF output power of each chain must be controlled by either a Level-Set , a Level-Control or a Delay-Line logical device (not shown in the block diagram).

Fault monitoring

The protection switch monitors the faults in each chain and controls the switch-over from these faults. A fault in an operative chain causes the protection switch to replace the faulty chain by the spare one. In contrast, a fault in the redundant chain prevents the protection switch from using the spare chain.

The device provides two modes of fault monitoring. If the 'faultMode' configuration parameter ist set to 'ALL FAULTS', the device monitor the summary fault states of all devices in a chain. If at least one faulty device is recognized and pending for 'switchDelay' seconds, a switch-over is triggered.

The device summary faults normally comprise all fault flags of a device including the communication alarm. There may be fault conditions which do not affect the RF performance of a chain and therefore should not trigger a switch-over. You may set such fault condition to the fault priority 'INFO' at each individual device to prevent them from being summarized in the device fault state.

The fault mode setting "HW FAULTS ONLY" ignores all device faults in the chains except for the fault stated by the 'hwFaultPrefix' devices. This mode is used to let the protection switch make up it's switch-over decision only from a fault reported by a relay circuit. Multiple relay circuits may be combined by hardware wiring or by sat-nms logical devices like the Gate-Array , Logical-Gate or the Logical-Gate-3 devices.

Klystron support

The protection switch supports the usage of a klystron amplifier in the spare chain. The klystron mode is enabled by defining a list of channel selector settings in the configuration / setup dialog.

In klystron mode, the protection switch commands a channel selector setting to the klystron amplifier during the switch-over process. RF power is kept OFF during the switchover until the klystron device states that it has successfully tuned to the commanded channel.

Switch-over and mirroring

If the device detects a fault in one of the chains and protection is enabled (globally for the device and individually for this chain), the device switches the redundant chain in place of the faulty one. The following happens:

1. In case of a klystron amplifier in the redundant chain, the channel selector setting for the chain to replace is applied to the klystron amplifier.
2. The input switch in front of the redundant chain is set to route the input signal of the defective chain to the redundant one.
3. If a "pre mirror delay" has been configured, the switchover procedure waits this time.
4. The parameters for the upconverter, modulator and auxiliary devices are mirrored from the defective to the redundant chain.
5. The level calibration values are copied as well
6. If a "post mirror delay" has been configured, the switchover procedure waits this time.
7. With a klystron amplifier, the switchover procedure waits until the amplifier's channel adjustment has completed. There is a 120 seconds timeout for this, the switchover gets aborted and a fault ist raised if the amplifier does not complete within this time.
8. If configured, the procedure checks the redundant chain input level and waits until this reaches a configurable threshold. For this a timeout value of 5 seconds applies, if the input level at the redundant chain is too low after this time the procedure aborts with a fault flag raised.
9. Now the EIRP setting is applied to the redundant chain to set the amplifier to it's nominal power. If an puling power control is configured and active, the device mirrors the UPC nominal output level instead. It applies a level offset to compensate the signal path addentuation, the offset is defined in the UPC device.
10. The output switches are set to route the defective chain to dummy load and the redundant chain to the antenna.

If the protection switch device is configured to the switch mode "RF-ON" instead of "WAVEGUIDE", step 9 is done slightly different: No switch is actuated, but the redundant EIRP controller is commanded RF-ON while the controller in the defective chain is commanded RF-OFF.

Switch faults

The protection switch device also monitors the fault state of the output switches and the fault state of the input selection switch of the redundant chain as well. If the device detects a fault at one of the switches, it raises a "Switch hardware" fault. This situation blocks any redundancy switching.

Temperature fault monitoring

The protection switch is capable to monitor an additional fault signal for each chain which reports a temperature alarm caused by the RF power generated in this chain. Dummy loads or filter/power combiners are possible sources for such a temperature fault. If such a fault is detected, the protection switch commands the faulty chain RF-OFF and disables protection switching for this chain.

Device window pages

The following table shows which device window pages are available with this individual device type. Tool-bar functions not mentioned here are described at the general description of device windows .

• --- This page controls the operational parameters of the device.
• --- The faults page.
• --- The device info page.
• --- The maintenance page. The configuration parameters described below are set at this page.

Configuration parameters

At the maintenance page of the device window there are a couple of configuration parameters which must be set to interconnect the redundancy switch with the devices it shall monitor and control.

Changes to most of the configuration parameter do not become effective until the VLC software is re-started. This is due to the fact, that the protection switch software has to allocate sat-nms parameters dynamically, depending on the number of chains configured. To signal this, the software sets the 'Config mismatch' fault flag as soon as such a configuration parameter is changed.

Fault descriptions

• Spare chain --- At least one device in the redundant chain states a fault.
• Switch configuration --- The switches are in an unknown or wrong position.
• Switch hardware --- At least one of the signal switches controlled by this device states a fault.
• Config mismatch --- This fault flag is set if changed or incorrect configuration settings prevent the device from normal operation. The 'state' variable at the 'info' page describes the reason of this fault:
  • RESTARTREQUIRED! --- Changes to most of the device's configuration parameters do not become effective until the VLC server software is re-started. If you change such a parameter, the 'Config mismatch' fault is set with this description. This and further changes to configuration parameters are stored properly, you can set all configuration parameter if the device in one pass and then restart the software.
  • NOCHAINS --- No chains were detected to configure. Probably you configured the device in RF-ON switchmode with comma separated device name lists. A dummy list of WG switches must be entered in this case (see below).
  • BADINDEXORDER --- You must define a 'lastIndex' > 'firstIndex'
  • TOOMUCHCHAINS --- The number of chains must not exceed the limit defined in the device driver file. Actually this limit is 12. In the device driver file you find a description how to extend this limit.
  • BADINDEX --- The index numbers must not exceed 99.
  • HWFAULTMISMATCH --- You've set the device to 'HW FAULT ONLY' mode, but did not specify a 'hwFaultPrefix'. The device will never detect a fault in this configuration and will never initiate a switch-over.
  • BADINPUTSWITCHTABLE --- The 'sw1Positions' configuration parameter does not device enough switch positions for the number of chains you defined. 'sw1Positions' must contain an input switch setting for each chain and additionally the switch setting for the setting 'NONE'
• Klystron channel --- Channel adjustment at the spare klystron amplifier timed out. 120 seconds after commanding the channel the amplifier still reported "adjust in progress". The switchover process has been aborted, the Protection-Switch-N-To-1 device is locked. This is a latching fault, you have to click RESET at the maintenance page to reset/release the fault condition
• Spare input level --- A spare chain input level check has been configured and the level did not reach the threshold value within 5 seconds. The switchover process has been aborted, the Protection-Switch-N-To-1 device is locked. This is a latching fault, you have to click RESET at the maintenance page to reset/release the fault condition
• Protect enable --- The global protection enable switch is OFF. By default this condition is treated as a fault. You may change the priority setting of this fault to "NONE" if you want to change thus behaviour.
• Chain-? protectenable --- The protection enable switch for this particular chain is OFF. By default this condition is treated as a fault. You may change the priority setting of this fault to "NONE" if you want to change thus behaviour. This is a latching fault, the next switchover will reset it. Alternatively you may click RESET at the maintenance page to reset/release the fault condition

Parameter mirroring

The table below states which parameters are remembered and set at the devices of the spare chain in case of a switch-over.

Standard and non-standard device indexing

The Protection-Switch-N-To-1 device provides an easy method to define the names of the devices referenced by the protection switch. The names are defined as prefixes, index are appended automatically to get the complete names. If e.g. firstIndex is 1 and lastIndex is 2, a prefix value "HPA-" would expand to the device names "HPA-R" for the spare device and "HPA-1", "HPA-2" for the operative devices at chains 1, 2.

There are situations where this naming scheme cannot be applied. This may happen if the device naming must match external conventions of if multiple protection switches are configured in one system, automatically indexed names would conflict. Specially the waveguide switch names often are critical for this. In such a situation the device names may be defined explicitly at the Protection-Switch-N-To-1 setup as described below:

1. Set firstIndex and lastIndex to 0
2. With sw2Prefix define the names of the waveguide switches at the end of each chain as a comma separated list of device names. The number of switch names defines the number of chains the device handles, the first name is assigned to chain 1. Example: "S22,S23" defines two operative chains, S22 routes the output of chain 1, S23 the output of chain 2.
3. For all devices you want to monitor or mirror, fill a comma separated list of device names into the ???Prefix field in question. All these lists must consist of n+1 device names, the first one for the chain 1 device name, the last one for the spare chain device name. Example: "ENC-13,ENC-21,ENC-R2" defines two operative devices ENC-13 (chain 1) and ENC-21 (chain 2), ENC-2R as the spare device for these.
4. A the sw2Prefix list determines the number of chains to operate, this list must be present even if the RF-ON switch mode is used. Enter a list of dummy device names in this case, one name for each chain to operate.

Variables defined by this device driver