TSL TM1 Mk3+ Operating instructions

1
TM1 Mk3+ Redundancy:
Installation and Operation Guide

2
Version History
Issue Date Change Details
1 05/11/21 First draft
2 23/05/22 Second draft
3 17/06/22 Third draft
4 30/06/22 Fourth draft
5 12/04/23 Fifth draft

3
Contents
Introduction ....................................................................................................................................................5
Terminology ................................................................................................................................................5
System overview.........................................................................................................................................6
Primary and Backup controllers ................................................................................................. 6
Active system controller ............................................................................................................ 6
Writing configurations ............................................................................................................... 6
Connecting to the system .......................................................................................................... 6
Ethernet .................................................................................................................................... 6
Backup Link................................................................................................................................ 8
GPIO and Serial Connections...................................................................................................... 9
What do I need to build a redundant system? .........................................................................................11
Main hardware requirements .................................................................................................. 11
Direct Link Cable...................................................................................................................... 12
TallyMan Redundancy Panel (TMRP)........................................................................................ 12
Hardware installation ...................................................................................................................................13
TM1-MK3+ ................................................................................................................................................13
Direct link and Ethernet ........................................................................................................... 13
IP addressing ........................................................................................................................... 13
TMRP.........................................................................................................................................................16
Mounting................................................................................................................................. 16
Power...................................................................................................................................... 16
Connections............................................................................................................................. 16
Open Collector Connections and Circuit ................................................................................... 17
Setup ....................................................................................................................................... 17
Software installation.....................................................................................................................................23
Opening the TallyMan software ...............................................................................................................23
Creating a new configuration ...................................................................................................................24
Modifying an existing configuration .........................................................................................................28
Operation......................................................................................................................................................31
TM1-Mk3+ Front Panel.............................................................................................................................31
TM1-MK3+ Display – Standalone Mode ................................................................................... 31
TM1-MK3+ Display – Redundancy Mode.................................................................................. 31
Status Descriptions ...................................................................................................................................32
Redundancy Menu....................................................................................................................................33
TMRP Connections................................................................................................................... 34
Normal Operation.....................................................................................................................................35

4
TMRP Operation .......................................................................................................................................36
Failover Mode ...........................................................................................................................................37
Automatic Mode...................................................................................................................... 38
Manually changing the Active Unit...........................................................................................................39
Failover Events..............................................................................................................................................41
Replacing a System Controller..................................................................................................................46
Primary System Controller ....................................................................................................... 46
Backup System Controller ........................................................................................................ 47
TMRP....................................................................................................................................... 47

5
Introduction
TallyMan TM1 MK3+ redundancy allows TallyMan control systems to continue to operate when an
unexpected issue occurs, or a system controller needs to be taken offline for maintenance. It operates on
an A->B failover basis: if a failover event occurs then the system will automatically deactivate its Primary
controller and activate the Backup controller so that operations can continue. This type of failover system
offers protection from events such as power failure, network interruptions or system failure and greatly
improves the ability to maintain operations in the occurrence of a failover event.
The TallyMan redundancy system has both automatic and manual failover modes, meaning that an
operator can change the failover mode from auto to manual to perform maintenance tasks with minimal
disruption to operation.
Terminology
The table below lists the terms used in this guide, along with the abbreviations that appear on the
TallyMan Redundancy Panel (TMRP) buttons.
Term
TMRP Term
Meaning
Primary
Primry
The unit that is expected to be in use during normal operation. Even if it fails over to the Backup
unit, it is still called the Primary.
Backup
Backup
The unit that is ready to take over from the Primary in the event of a failover. Even if it becomes
Active, it is still called the Backup, since it is assumed that normal service will eventually be
restored, and the Primary will take control again.
Active
Active
The Active TM1 (either Primary or Backup) has functional control over the redundancy system.
Standby
Stndby
The Standby TM1 is working correctly and ready to take over functional operations when
required. Note the ability to take over control is determined by other settings within the system
such as the Failover Mode.
Activating
Acting
A TM1 that is in the process of becoming Active.
Deactivating
Deactg
A TM1 that is in the process of Deactivating to enter Standby mode.
Unavailable
Unvail
A TM1 that is not available to be either Active or in Standby mode.
Failover Mode
F.Over
The Failover mode, changes between Auto and Manual failover operations.
Automatic
Failover
Auto
Automatic Failover mode – The system monitors itself to determine if a failover event has
occurred and then implements the failover action.
Manual Failover
Manual
Manual Failover mode – The user is free to change over the Active unit manually; while in this
mode the system will not failover automatically.
Auto Armed
Auto: Armed
Failover mode is in Auto AND the system is ready to act in the occurrence of a failover event.
This is only available if the Primary is Active.
Auto Triggered
Auto: Trggd
Failover mode is in Auto AND the system has triggered a Failover action. The Backup TM1 is the
Active unit.
Auto Unavailable
Auto: Unavbl
Failover mode is in Auto. However, the system is not able to act in the occurrence of a Failover
event. This could be due to a physical connection issue, network issues or errors in the system.

6
System overview
This section explains the basic principles behind a redundant system.
Primary and Backup controllers
The Primary system controller is the main system controller and during normal operation will perform the
operational functionality. Once designated as the Primary during configuration, the system controller will
always be the Primary within the system until the configuration changes.
The Backup system controller is also designated during configuration and is always the Backup system
controller in the redundancy system. In normal operation the Backup will operate in Standby mode
whereby it is continuously synchronised with the Primary and monitors the Primary’s health. In the event
of a Failover, the Backup will assume control by Deactivating the Primary and becoming Active.
Note that the synchronisation is from Primary to the Backup. Once the Backup becomes Active then the
Primary will not remain synchronised with the Backup. Restoring the Primary to be the Active system
controller is a Manual operation, at this point the Backup will return to Standby mode and synchronise
itself with the Primary again.
Active system controller
The Active status denotes the system controller that is currently actively controlling the system. Either
the Primary or Backup can be active, only one can be Active at any time. Note the Primary is always the
Primary and the Backup is always the Backup, it is the Active state that determines which unit is currently
in control.
Writing configurations
When using the TallyMan configuration software, unless connected to the system, all configuration is
performed offline. Configuration files are always written to the Primary system controller using the NIC1
IP address as defined in the configuration. Upon receiving a new configuration, the Primary will load the
configuration file and reconfigure itself accordingly to establish which mode to run in and whether it is
designated as Primary or Backup. Once it has determined it is the Primary and finished loading, it will
then automatically write the configuration to the Backup unit, which will then go through the same
process to determine its mode and function.
Connecting to the system
Each system controller has two Ethernet NICs and can thus support two separate networks. Writing
configurations and connecting to the system is performed using the static IP address assigned to these
NICs. You must use NIC1 to connect to the system.
Within a redundancy system there is also a virtual IP address assigned to each NIC. This is used for
communications to equipment outside of the redundancy ‘bubble’.
Ethernet
Each TM1-Mk3+ unit can support two separate networks to perform control functions. For a redundant
system, both units must use the same subnets for each NIC. For example, if NIC 1 of the Primary TM1-
Mk3+ is on the subnet 192.168.10.XXX then the Backup unit’s NIC 1 must also use the subnet
192.168.10.XXX. See IP Address and VIP assignment example.
Each NIC port also hosts a Virtual IP address (which must be on the same subnet as the permanent IP
address) that is defined in the TallyMan configuration software (as described below). This is different to
the static IP addresses that are configured via the front panel of each unit and is used as part of the
redundancy operations.

7
The NIC 1 port is the uppermost Ethernet port on the rear of the TM1-MK3+ system controller. NIC 1
supports the redundancy system and is used for communications between the units. Connection to
external equipment can be via either of the NIC ports.
Virtual IP Addresses (VIPs)
The system utilises VIPs to simplify any external communications to either TSL equipment (such as control
panels or GPIO expansion) and to third-party equipment (such as routers and switchers). The VIPs (one
per NIC) are dynamically applied to the currently active unit. In the event of a failover, either manual or
automatic, the VIP is removed from the previously active unit and then applied to the newly active unit.
This mechanism allows for an almost seamless transition in the event of a failover, with the same IP
address being used so that external equipment can continue to communicate to the TallyMan control
system.
The VIP mechanism has a failsafe to prevent both TM1-Mk3+ system controllers using the same address
at the same time. In most cases, the VIP is disabled from the deactivating unit then enabled to the
activating unit. The activating unit will not enable the VIPs until it can be certain the VIPs have been
disabled on the deactivating unit. If this procedure cannot be completed, the Backup unit can shut down
the Primary unit to ensure that the VIPs are not being used.
IP Address and VIP assignment example
The table below shows some example settings for IP addresses and VIPs on TallyMan equipment in a
redundant setup.
Unit
NIC 1
NIC 2
VIP
Primary
192.168.10.1
192.168.20.1
192.168.10.4
Backup
192.168.10.2
192.168.20.2
192.168.10.5
TMRP
192.168.10.3
N/A
N/A
Under normal operation, the Primary is Active, and hosts the Virtual IP addresses:

8
During a transition, the Primary is Deactivating, the Backup is Activating, and there is no direct
connection via the VIP:
After failover, the Backup unit is Active and hosts the Virtual IP Addresses, and the Primary unit is in
Standby:
During Backup operation, the Backup unit is Active and hosts the Virtual IP addresses; the Primary unit is
Remotely Shutdown:
Backup Link
The Primary and Backup system controllers communicate via two links, the Direct Link cable and the NIC
1 Ethernet port (labelled as IP Link). These two-communication links allow for the monitoring between
the Primary and Backup; both are required for a redundant system to work correctly. The status of both
communication links between the system controllers is displayed on the front panel of the TM1-MK3+
when it is configured in redundancy mode:

9
GPIO and Serial Connections
The GPIO and Serial connections of TM1 in a redundant system can be setup in the following ways:
•Using a VIP connection (preferred)
•Using a Changeover device
Using a VIP connection
In this approach, the Serial and GPIO are moved outside of the redundancy ‘bubble’ and interface to the
system via the VIPs. To achieve this, we use a GPIO expansion device such as the TSL ESP-1R+. This
expansion device will then connect to the system via the VIP address and communicate with the system
without any requirement to know which TM1 is currently Active.
Serial devices can be set up in a similar way using an Ethernet-to-Serial convertor. The convertor will
communicate to the TallyMan system using a VIP address and continue to operate after a Failover event
has occurred.
The diagram below shows the connection of external GPIO and Serial devices to the TallyMan
Redundancy system when the Primary is Active and hosting the Virtual IP addresses:

10
The diagram below shows the connection of external GPIO and Serial devices to the TallyMan
Redundancy system when Backup is Active and hosting the Virtual IP addresses:
Using a Changeover device
An alternative approach is to use a changeover device such as the TSL SW2x1 changeover frame. The
required GPIO and Serial connections are routed thorough the changeover device from both the Primary
and Backup TM1 units. The output of the changeover device is then connected to the equipment as
required. The operation of the changeover unit is controlled by the GPO of a TMRP that will reflect the
status of the current system. The connections from the Active system controller will then be routed to
the output of the changeover unit and then on to any third-party devices as required.
The diagram below shows GPIO and Serial connections connected to third-party equipment via a
changeover unit, controlled by the GPIO system status of the TMRP. Multiple TMRP units can be
paralleled for changeover control redundancy:

11
What do I need to build a redundant system?
To create a redundant system, you need:
•1 x Redundancy licence
•2 x TallyMan TM1-MK3+ controllers
•1 x Direct Link cable to connect the controllers
•1 x TMRP unit
•Associated networking, power supplies and cables.
Main hardware requirements
There are two possibilities, depending on whether you already have a system built around a TallyMan
TM1-MK3+:
•TallyMan Redundancy Package
•TallyMan Redundancy Kit
TallyMan Redundancy Package
If you do not already have a system based on a TallyMan TM1-MK3+ system, you can purchase a
complete TallyMan Redundancy Package, which contains the following:
•2x TM1-Mk3+ system controllers
•1x TallyMan Redundancy Kit (see below)
Tallyman Redundancy Kit
If you already have a system based around a single TallyMan TM1-MK3+ controller, you will need to
purchase a second TallyMan TM1-MK3+ controller, along with the TallyMan Redundancy Kit which
contains the following:
•1 x Redundancy licence
•1 x Direct Link Cable to connect 2x TM1-MK3+ units for auto negotiation and synchronisation
•1 x TMRP 4-button LCD control panel to monitor and manage automatic/manual failover from
anywhere in your network. Has external triggers for local alarming and controlling external
switchboxes to switch physical I/O
•1x TMRP 1RU mounting panel
•1x TMRP power supply
The TM1-Mk3+ units are designated by the user as either the Primary or the Backup. The Primary unit is
the unit that is expected to be in use during normal operation. The Backup is placed into Standby to
monitor the Primary; in the event of a failover the Backup will become active while the Primary will
deactivate.
During normal operations the Primary and Backup units are synchronised with all relevant state changes
so that in the event of a Failover the Backup can continue the control operations. Note that when the
Backup is Active, the Primary unit is no longer synchronised with the Backup so it is possible some states
will not be same between the units. When the Primary is restored to being the Active unit the Backup will
synchronise with the Primary again.

12
Direct Link Cable
The Direct Link cable connects the 2x TM1-Mk3+ system controllers together for monitoring and control
purposes. The cable connects to the WatchMan connector on each unit:
TallyMan Redundancy Panel (TMRP)
The TMRP is a hardware unit dedicated to redundancy operations. It can be mounted onto a 1RU bracket
(supplied) for use in technical furniture, or into a racking system. (Other mounting methods are
available.)
The unit provides real-time status of the redundancy system as well as offering user controls to change
functions such as Failover mode and activating a unit. In addition, the unit has GPO to provide external
systems or changeover units with the active status of each TM1-Mk3+ unit in the system.
Note the buttons (with LCD displays) used on the TMRP are limited to 6 characters, so some terms and
messages have been abbreviated to ensure they fit on the display.
The TMRP has four buttons:
Button
Button Label
Description
Primary
Primry
Functional button dedicated to the status and operation of the Primary TM1
Backup
Backup
Functional button dedicated to the status and operation of the Backup TM1
Failover
F.Over
Functional button dedicated to the status and operation of the failover mode mechanism
Enable
Enable
Button dedicated to enabling the operation of the functional buttons

13
Hardware installation
Note: At time of writing, redundancy is only supported by the TM1-Mk3+.
Note: This guide focuses on a redundancy setup. For specific information about GPIO and Serial
connections, please refer to the appropriate TSL TallyMan manual.
TM1-MK3+
Direct link and Ethernet
To make the hardware connections:
1. Connect the Direct link cable between the WatchMan ports on both units.
2. Connect the Ethernet cables for each network connection.
IP addressing
To set up IP addressing, use the encoder and display on the front panel of each unit:
1. On the first unit, press the encoder to enter the Setup Menu.
2. Set up IP addressing for NIC 1 on the unit:
a. Scroll the encoder to the IP 1 item and press to display the IP Address 1 Menu.
b. Scroll the encoder to the Address item and press to highlight the first octet.
c. Scroll the encoder to set the value for the first octet, then press to highlight the next
octet.
d. Repeat to set the other two octets; the final press of the encoder will deselect the
Address item.
e. Repeat to set the Netmask and Gateway for NIC 1 on the unit.
f. Scroll to Save and press the encoder. The display will return to the Setup Menu.
3. If using a second network interface, repeat step 2 using the IP 2 menu item.
4. In the Setup Menu, scroll the encoder to Back and press to return to the main display.

14

15

16
TMRP
The TMRP is a compact switch button unit that is dedicated to display status and control of the
redundant system.
Mounting
The unit is supplied with a 1RU mounting bracket and two blanking plates. The TMRP can be mounted in
any one of three positions.
Power
The TMRP has both a DC power input for use with the supplied 12Vdc PSU and PoE (Power over Ethernet)
to receive power from a PoE enabled ethernet switch. Either power method can be used, or both can be
used in conjunction to provide resilient power for the unit.
Connections
The TMRP has several connections available. Power (either 12Vdc or PoE) and ethernet are required to
be able to operate with the TallyMan Redundancy system however, in addition, there is GPO available
that can be used to trigger external changeover units or feed status into a monitoring system.
1
DC Power Connector
12Vdc
2
Factory Restore
Button
Restores factory settings – Resets IP address and password of unit
3
Ethernet (PoE)
Connector
100Base-T Full Duplex, PoE Class 3, 12 Watt
4
GPO Connector
Open Collector Outputs
GPO 1
Primary Active
GPO 2
Backup Active
GPO 3
System is Armed
5
5V Output
+5Vdc (800mA Max)
Slot 1 Slot 2 Slot 3

17
Open Collector Connections and Circuit
Setup
When first powered the TMRP will display its current IP settings and model number for a few seconds
before completing its boot process. Once fully powered the unit will display the status on the TallyMan
redundancy system. In its default state the TMRP is unconfigured, the buttons will show the following:
This display shows the TMRP currently has no connection to either the Primary or the Backup system
controllers. To configure the TMRP as part of the redundant setup it must have an IP address assigned
that is within the same subnet as the Primary and Backup’s NIC 1 port and be included in the system
configuration that is written to the Primary and Backup system controllers.
You set up the TMRP using a web page.

18
To access the TMRP webpage and log in:

19
Changing the password:
To change the IP settings:
Note: The TMRP must be on the same subnet as the Primary and Backup’s NIC 1 port.
To change the TMRP label:

20
To load a new configuration:
The configuration dictates the behaviour of the TMRP, this is not user definable, but in the case where a
new configuration is issued it may be necessary to load the new one.