Using the Frame Control Panel > Using the Frame — Controller Settings > Configuring Redundancy > Protection Chains and Priorities

Protection Chains and Priorities

The controller module supports multiple protection layers, so a backup module can have protection applied to itself as well. The protection relationship could look like the figure below.

Protection of Modules within a SEL-MCP3 Frame

In the figure above, the module in slot 1 is a primary module, configured to designate the modules in slots 2 and 3 as backup. The modules in slots 2 and 3 are assigned a priority order where the first module to pick up a failed module’s service is the lowest priority, in this case the module in slot 2 (note that in the figure above, the protection status for slot 2 is Unavailable, because there is no slot that is lower priority to take over its service if required.

This relationship between the modules is indicated in the figure above at the top of the group’s Slots listing in the following notation:

(1) ->(2,3)

The priority slots are in parentheses to indicate they are not protecting any module and their functionality is protected.

Slot 2 is the lowest priority, so when slot 1 fails, slot 2 will pick up that service. If slot 2 fails as well, slot 3 will be the next slot to replace slot 1’s functionality.

Below, the module in slot 3 has failed. Because the module in slot 2 has been assigned a lower priority, it takes over the service the of the higher priority module.

Protection in Action in a SEL-MCP3 Frame

Note: For instructions on how to configure a module as a primary or backup module, see Configuring Module Redundancy . Redundancy for processing modules requires configuration of external equipment such as routers and supporting wiring. These topics are described in Configuring the Router  and Using the Connections Manager .

All modules are eligible to carry service, regardless of their protection mode. A protection module's service can be discarded if a failover selects that module to pick up a failed primary module's service. The protection graph implicitly sets priorities for module selection during failover. Modules with longer protection chains (e.g., the module in slot 1 above) have a higher priority than those in redundant slots (modules in slots 2 and 3 above). In the figure above, the services on module 1 have the highest priority, and that module is not designated as backups for failover duty. The service on the module in slot 2 has the lowest priority, so 2 will be chosen first for backup duty.

The controller module tries to preserve higher priority services, potentially at the expense of lower priority services. A backup module inherits the primary module's priority during a failover. That backup module can be selected again for failover duty, if another module with a higher priority needs protection.

A few examples illustrate the behavior (using the figure above with modules in slots 1 through 3).