CIU 888 Redundancy and Rheonics Sensors: Failover Behavior and W&M Sealing Print

TABLE OF CONTENTS

• 1. What gets synchronized
• 2. Failover expectations
• 3. W&M sealing: Configuration lock vs. W&M lock
• 4. Practical checklist for a redundant site
• Related articles
• References

Redundant CIU 888 sites use two physical units, referred to as the Primary and Secondary CIU 888, linked through their Sync Link ports at the back of each unit using a Cat. 5 Ethernet cable. Only one of the two is active at any time; the other is passive. Either the Primary or the Secondary can hold the active role, since the active role is a runtime state, not a fixed identity.

Figure 1. Redundant CIU 888 pair: configuration replicates from the Primary to the Secondary over the Sync Link, while the Rheonics sensor sits on the field bus

The SME is available in three variants (Figure 2). All three carry the same Modbus RTU registers, so everything in this article applies to any of them; the variant only changes the installation.

Figure 2. Rheonics Sensor Electronics (SME) variants: E1: SME-TRD, E2: SME-TR and E3: SME-DRM

1. What gets synchronized

When a Primary CIU 888 is configured, its site configuration, including field port setup and device definitions, is synchronized to the Secondary (Passive) CIU 888 automatically through the private Sync Link. This is the recommended setup path for most sites: the CIU 888 handles configuration synchronization on its own, rather than requiring the same configuration to be entered twice.

According to the Configuration Manual, the synchronization covers configuration only: site configuration, tank definitions and field port setup are copied from the Primary to the Secondary [1].

2. Failover expectations

A switchover is only valid when both CIU 888 units are fully synchronized. When that condition is met and a switchover occurs, whether triggered automatically by Entis Pro, by a Modbus host, or issued manually, the unit that held the active role assumes the passive role, and the unit that held the passive role assumes the active role and continues the tasks the previous active unit was performing.

• Automatic switchover: Entis Pro can issue a switchover automatically under certain hot-standby conditions.
• Manual switchover: if both CIU units report the same status value, an operator has to issue the switchover command directly to make one of them active.
• Not fully synchronized: if the two CIU 888 units are not fully synchronized, a switchover is not considered valid. On the troubleshooting side, this shows up as blank Tank Detail data in Entis Pro until the Secondary CIU 888 is restarted or resynchronized.

3. W&M sealing: Configuration lock vs. W&M lock

The CIU 888 has two independent physical key switches at the front of the unit. A common question is whether they lock measured values or configuration; the answer depends on which switch, as summarized in Table 1.

Table 1. Configuration lock and W&M lock key switches

Neither switch stops the SME from measuring or the CIU 888 from scanning it. Both locks only govern whether configuration, the settings that determine how a measured value is scaled, mapped, or calculated, can be changed. If the CIU 888 does not feature the sealing option at all, both key switches can be left locked or unlocked at the site's discretion; sealing is only meaningful where a Legal Metrology authority is actually involved.

4. Practical checklist for a redundant site

• Confirm field wiring with Honeywell or your integrator: available documentation does not state the required field wiring topology for third party Modbus devices in a redundant setup; confirm this directly rather than assuming.
• Confirm Sync Link: the Primary and Secondary must be connected via their Sync Link ports for configuration to replicate automatically.
• Check synchronization status: before relying on failover, confirm both units report fully synchronized; an out-of-sync pair will not perform a valid switchover.
• Know which lock applies: use the Configuration lock for routine change control, and treat the W&M lock as the responsibility of the Legal Metrology authority of the site.
• Re-verify after any configuration change: per the Sealing Guide, any change to W&M-relevant configuration on a sealed site requires the W&M lock to be reopened and, typically, re-inspection [3].

Related articles

References