9.172 Downconverter-Protection-Controller

The Downconverter-Protection-Controller logical device builds together with the Protection-Switch-N-To-M device a n:m redundancy solution for satellite downconverters, which supports a pool of backup devices from which one device is taken in case of failure of an operative device. In case of a redundancy switch all device parameters are mirrored to the spare device, so all downconverters in the pool (active and spare ones) must be exactly of the same type.

For n:m redundancy, one Protection-Switch-N-To-M device and for each managed downconverter a Downconverter-Protection-Controller device are configured in the M&C device setup. This distribution across two device types enables a very flexible configuration of the redundancy, so there is no explicit limit on the number of managed downconverters.

The devices are based on the following device configuration:

• The user has a freely definable number of identical devices, some of which act as spare devices, the rest are operational.
• The downconverters select their input signals from a distributive switch matrix.
• The outputs of all downconverters are wired to the inputs of a distributive switching matrix.

In the event of a switchover, the input switch position of the primary device gets copied to the input switch of the backup device, then all downconverter parameters are mirrored and finally the output switch matrix is commanded to set all outputs which originally pointed to the primary downconverter now to the backup one.

The Downconverter-Protection-Controller device carries out the actual task of monitoring and redundancy switching. One Downconverter-Protection-Controller device is configured for each of the downconverter involved. Whether the individual downconverter is an operational or a spare device can be switched "on the fly" using a configuration parameter. In addition, a protection controller device can be configured to the INACTIVE state, which designates a device that is neither PRIMARY nor SPARE, e.g. as a placeholder for later extensions or if a device is temporarily unavailable.

Each Downconverter-Protection-Controller device monitors two configurable fault flags. The first fault is labeled "general fault" and should combine all fault which prevent a downconverter from being used. The second fault ("operational fault") should be active with fault conditions that shall trigger a redundancy switching but shall not prevent a spare downconverter from being used if this fault is active. A missing input signal is an example for this type of fault.

When performing a redundancy switch, the device first requests a free spare device from the Protection-Switch-N-to-M device. It mirrors the settings of the device to be replaced on this and then sets the matrix outputs in such a way that the output of the spare downconverter is routed to the destinations that were previously served by the replaced downconverter.

The redundancy switch can also be triggered manually by clicking REPLACE-BY-SPARE. In the same way, after the replaced device has been repaired/checked, it can be switched back to operational mode (SWITCH-BACK). The original matrix configuration of the device is restored, but no downconverter parameters from the spare device are mirrored back to the primary one.

Controllers configured as SPARE may be bound to a certain primary downconverter. In this case the spare device is no longer part of the spare pool, instead it acts as a 1:1 backup for the selected primary downconverter. Use the 'reserved for' parameter to configure this feature. Controllers which have the 'reserved for' parameter set to NONE are part of the spare pool.

By default device parameters are mirrored after the backup downconverter input switch has been commanded and before the switch matrix is set to swap the downconverter output signals. For 1:1 downconverter pairs a different approach may be configured. If the '121MirrorMode' config parameter is set to IMMEDIATE at the primary controller, mirroring is skipped during the switchover procedure, thus speeding this up significantly. Instead mirroring the device parameters is triggered by the following events:

• A backup downconverter is configured as 'reserved for' for this primary downconverter.
• The operator clicks the MIRROR NOW button.

Device window pages

The following table shows which device window pages are available with this individual device type. Tool-bar functions not mentioned here are described at the general description of device windows .

• --- This page controls the operational parameters of the device.
• --- The faults page. --- The device info page.
• --- The maintenance page. The configuration parameters described below are set at this page.

Configuration parameters

At the maintenance page of the device window there are a couple of configuration parameter which must be set to interconnect the redundancy switch with the devices it shall monitor and control.

Variables defined by this device driver