Controller Redundancy

Hi everyone
Can anyone advise if there's been any exploration on how to implement hot redundancy controller through Ethercat, as shown in the video:

I've already posted a question in the developer's query thread on GitLab, but I'm waiting for a response. Maybe someone on the forum has looked into how to do something similar. I would like a theoretical understanding of at what level of abstraction this could be done. In etherlab master and then somehow link it with Hal (Linuxcnc). Or does Etherlab master already have the necessary functions, and it needs to be implemented in Hal somehow. I would like to discuss this topic.

you means double cable in/out on master or use 2 master for same ethercat ecosystem? These for safety pourpouse?

- for second option, MY PERSONAL THOUGHT (not so important): safety is safety ... better use a certifyed standard safety plc like el69xx with cpu inside or electromecanical one or a saparate safety plc. For the economic health of those who use Lcnc for work. Unfortunately work => insurances .... insurance => I hate do-it-yourself. These is expecialy right for safety on work.
- for first option is really a good things if a master go off, other one stay up? In aereospace, trasportation or medical is for sure interesting .... but in real work better to investigate the real problem instead go without control the damage. Because have a master down indicate a big problem not a little one.

After these for sure somethings is done .... a Etherlab asian based ethercat master become redundant in 2022/2023 for railways ethercat master control devices.

Of course, my post was specifically about the option using 2 controllers. With two cables, everything is clear and works perfectly. Thanks for reminding me about Twinsafe. I forgot about it, but honestly, I have never worked with it and don't know how it works with lcnc? Of course, I mean the operability of all its advantages. That the blocks work as regular inputs/outputs - I have no doubt.
We're not talking about making something haphazardly and solving the problem initially. We're talking about operating in emergency situations at nuclear stations and the like. The master can fail for various reasons: condensation, mechanical damage, or something similar. I call it: 'The operator's hair twitched at the wrong moment.' The question is exactly how this can be implemented in the Hal+Etherlab master combination. Maybe there were some solutions that involve only Hal. I'm even considering using this with OPC UA. But ideologically, it's not quite right.
As for the Asian solution - I didn't quite understand? Many companies have this feature. But it's done at the level of Codesys or Twincat (and as I heard, it doesn't work very well). Siemens has a solution, etc. The question is, at what level of abstraction is this implemented? Ideally, it should work like in the video: one controller turned off, the other turned on without delay. The first rebooted - the second broke down. The first turned on again, and so on.

The ethercat conf file supports multiple masters if correctly configured.
I'm not sure if this is supported by the linuxcnc driver.

In general, I conducted an experiment. I took two controllers and set them up with master and backup MAC addresses. I then connected an EtherCAT slave device between them. In this situation, neither of the controllers could see the slave device. As soon as I disconnected one controller, the slave devices immediately appeared. I have two ideas to solve this. The first is to configure one of the controllers as a bridge, where one Ethernet port sends information to the second port. In essence, the controller would work as a sniffer. It would effectively operate like a switch with the ability to capture packets (similar to Wireshark). If the first controller encounters a fault, the second controller will stop acting as a bridge and become the EtherCAT master

From what I can see, you would need 4  NICs as to get redundancy, you need to run a ring topology. Wheter iGh supports that is another story. Refer to the diagrams here infosys.beckhoff.com/english.php?content.../1446583307.html&id=
 

twinsafe work outside Lcnc ... you make your program on beckhoff soft, load on EL69xx with logic, than start Lcnc ... at these moment Safe logic work outside Lcnc and can block motor for example .... normally you use some pin for comunicate with Lcnc ... but safe logic can stop evereting without Lcnc .... only need master is on.