DLR

What is DLR?

DLR (Device Level Ring) is a redundancy protocol at layer 2 of Ethernet that daisy-chains devices with a built-in two-port switch into a ring, so that an IP network keeps running via the other side of the ring within a few milliseconds after a single cable break or device failure. The protocol was originally developed by Rockwell Automation and is now managed by ODVA as part of the EtherNet/IP specification. One device acts as the Ring Supervisor, the others are ring nodes. With default settings, a 50-node ring recovers in less than 3 ms.

DLR provides redundancy at the device level: PLCs, drives, O modules and HMIs form the ring themselves, instead of each device needing its own port on a central switch.

🧠 How does DLR work?

DLR is a form of ring redundancy in industrial automation. A ring topology always contains a loop, and a loop in an Ethernet network makes frames circulate endlessly. The Ring Supervisor prevents this by logically blocking one of its two ring ports for normal traffic. The network then behaves like a line, with a standby path ready for use.

1. Beacons - the active supervisor sends beacon frames out of both ring ports, every 400 µs by default.
2. Normal state - when the beacons arrive back at the other port, the ring is intact and the second port stays blocked.
3. Fault detection - when beacons stay away longer than the beacon timeout, or a node reports via a link status message that its neighbour has dropped out, the ring enters the fault state.
4. Recovery - the supervisor unblocks its second port and the nodes flush their MAC address tables. The ring is now two lines running from the supervisor, and all traffic finds a new route.
5. Return - once the break is repaired, the supervisor sees its beacons circulate again, blocks the port once more and the ring returns to the normal state.

DLR frames are not IP traffic: they use their own EtherType (0x80E1) and need no IP address. The mechanism therefore works independently of RSTP or other spanning tree variants, which you disable on DLR ports.

🧱 Which roles exist in a DLR ring?

Which supervisor is active is decided by the precedence, a value from 0 to 255. The device with the highest value wins; on a tie, the highest MAC address wins. Two-port devices that do not support DLR can in theory sit in the ring, but ODVA advises against it: they create blind spots for fault location.

🔧 Which parameters and values are typical?

In the CIP object model, DLR is the DLR object (class 71, hex 0x47). Through this CIP object you can read the network status, among other things: Normal, Ring Fault, Unexpected Loop Detected, Partial Fault or Rapid Fault/Restore Cycle. The object offers services such as Verify Fault Location, which pinpoints the fault between two nodes, and Clear Rapid Faults, which returns the supervisor to normal operation after a series of rapid faults.

🔄 What is the difference between DLR, MRP, RSTP and PRP?

DLR and MRP do the same job but belong to different ecosystems: the protocol usually follows the control system. Never run two ring protocols, or RSTP, on the same ring ports, because two mechanisms that both block ports will work against each other. If not a single frame may be lost even during a fault, choose PRP or HSR instead of a switching ring.

🏭 Where is DLR used?

• Machine building - OEMs build a ring inside a machine or skid, so that a broken cable or a powered-down drive does not stop the rest.
• Motion control - beacon-based nodes recover fast enough to stay within the timeouts of connections to drives.
• Rockwell architectures - Allen-Bradley modules such as the 1756-EN2TR for ControlLogix and dual-port controllers such as CompactLogix support DLR, and you configure the ring in Studio 5000 or with the switch software.
• Cell zones in plant networks - in the Converged Plantwide Ethernet architecture from Rockwell and Cisco, DLR forms the fast ring within the cell, while industrial switches above it connect to the distribution network using RSTP or another protocol.
• Priority and separation - DLR is combined with VLANs and QoS, so that control traffic takes precedence over diagnostics and engineering traffic.

🧭 How do you design and manage a DLR ring?

1. Choose DLR with EtherNet/IP - if the installation uses PROFINET, MRP is the more obvious choice.
2. Limit the ring size - design for the recovery time specified for 50 nodes. Larger rings recover more slowly and are more likely to suffer a second fault.
3. Assign supervisors deliberately - one active supervisor with the highest precedence and one back-up with a lower value. Keep the supervisor function disabled on other devices.
4. Avoid non-DLR devices in the ring - connect single-port devices via a ring tap or outside the ring.
5. Align the timeouts - the ring recovery time must fall well within the timeout of the I/O connections, otherwise the I/O still drops out during recovery.
6. Route the ring physically apart - do not run both directions of the ring through the same cable tray, or a single incident damages both paths.
7. Monitor the ring status - after one break a ring still works but is no longer redundant. Read the DLR object status in the controller, the HMI or via SNMP on the switch, and raise an alarm on Ring Fault.
8. Test recovery - during commissioning, pull a cable and check that production continues and the fault is reported at the right location.

🔐 How do you secure a DLR ring?

DLR frames carry no authentication. A device with a higher precedence can therefore announce itself as supervisor, and a misconfigured device can disrupt the ring or block recovery. CIP Security protects CIP connections with TLS and DTLS, but not the DLR frames at layer 2.

• Physical access - the ring usually sits inside the machine or control cabinet. Locked cabinets and closed, unused ports are the first line of security.
• Port Security - restrict on the switches at the edge of the ring which devices may connect.
• Network monitoring - passive monitoring and a network analyser such as Wireshark recognise DLR frames, unexpected supervisors and Unexpected Loop events. Forward ring faults to your SIEM as well.
• Segmentation - keep the ring within one cell and separate that cell from the rest of the Control Network according to the zones and conduits model of IEC 62443.
• Inventory - record supervisor settings in your asset inventory, so that a changed precedence stands out.

For organisations that fall under NIS2, in the Netherlands implemented through the Cybersecurity Act in force since 15 August 2026, the availability of such networks is part of the duty of care. With the Machinery Regulation, machine builders will also face explicit requirements against corruption of control systems from 20 January 2027.

❓ Frequently asked questions

What does DLR stand for?

DLR stands for Device Level Ring. It is the ring redundancy protocol of EtherNet/IP, originally developed by Rockwell Automation and now managed by ODVA. Devices with two Ethernet ports together form a ring that recovers within milliseconds after a single fault.

How fast does a DLR ring recover?

A 50-node DLR ring recovers in less than 3 milliseconds with the default beacon settings. Beacon-based nodes detect a fault within about 400 to 800 microseconds, while announce-based nodes need several milliseconds. Larger rings and longer timeouts make DLR recovery slower.

Do I need a managed switch for DLR?

DLR does not need a central switch, because the devices themselves contain a built-in two-port switch. At least one device in the ring must be able to act as Ring Supervisor, such as a communication module or a managed switch with DLR support. Single-port devices connect to a DLR ring via a ring tap.

Can I combine DLR and MRP?

DLR and MRP cannot run on the same ring ports, because both block a port and would then work against each other. A DLR ring and an MRP ring can, however, coexist in the same network, coupled through a switch. The protocol usually follows the control system: DLR with EtherNet/IP, MRP with PROFINET.

What happens with two faults in a DLR ring?

A DLR ring protects against a single fault. After the first cable break the ring has become two lines, and a second break separates part of the devices from the rest. That is why you should report and repair a DLR fault immediately, even while production keeps running.

Is DLR secure against attacks?

DLR itself has no authentication, so a device with a higher supervisor precedence or a faulty configuration can disrupt the ring. Securing a DLR ring therefore relies on physical protection, port security, segmentation according to IEC 62443 and monitoring of the ring status. CIP Security protects the CIP connections, but not the DLR frames themselves.

📌 In summary

DLR is the ring redundancy protocol of EtherNet/IP that lets PLCs, drives and I/O form a ring themselves, which recovers within a few milliseconds after a single fault. A Ring Supervisor sends beacons every 400 µs by default, blocks one port and opens it when the ring breaks. Design with a limited ring size, a back-up supervisor and monitored ring status, and secure the ring physically and through segmentation, because DLR itself has no authentication.