Ring Supervisor

What is a Ring Supervisor?

A Ring Supervisor is the device in a redundant Ethernet ring network that actively monitors the ring, keeps one ring port logically blocked to prevent a loop and, when a cable breaks or a node fails, unblocks that port so traffic keeps flowing via the other side of the ring. The term comes from DLR (Device Level Ring) for IP; in MRP the same role is called the Media Redundancy Manager (MRM). Without an active supervisor or manager, a physical ring is not redundancy but a loop, which can bring the network down within seconds.

The Ring Supervisor is the guardian of the network ring: it decides when the backup path is switched in and is therefore the core of every Ring Redundancy configuration.

🧠 What exactly does a Ring Supervisor do?

An Ethernet ring is in principle an error: frames have no hop limit, so a broadcast would circulate forever. The supervisor solves this and at the same time checks whether the ring is intact. Its tasks:

• Preventing a loop - of its two ring ports it blocks one for normal traffic. The network then behaves like a line with a standby path, a closed topology that is logically open.
• Monitoring the ring - it periodically sends test frames (beacons in DLR) out of both ports around the ring. If they return on the other side, the ring is intact.
• Detecting a fault - if the test frames stop arriving, or a node reports that its neighbour link has dropped, the ring enters the fault state.
• Switching over - the supervisor unblocks its second port and instructs all nodes to flush their MAC address tables, so traffic learns a new route.
• Locating the fault - in DLR the active supervisor reports, per port, the last node it can still reach (last active node). This tells the technician between which two devices the break lies.
• Restoring - once the break is repaired, it sees its test frames circulate again and blocks the port once more.

Importantly, the supervisor does not reroute process data itself. It only manages the ring topology; the PLC, drives and O only notice the brief interruption during the switchover, which is why the recovery time matters.

🔍 What is the supervisor role called in the different ring protocols?

Every switching ring protocol has one device that manages the ring, but the name and the election mechanism differ.

In MRP a Media Redundancy Automanager (MRA) automatically decides which device becomes MRM. A lower priority value wins; the default for a fixed MRM is 0x8000 and for an MRA 0xA000. On equal priority the MAC address decides.

🏭 Which devices can act as Ring Supervisor?

In practice the supervisor role goes to a device that is always powered and easy to reach for diagnostics:

• Controllers and communication modules - two-port Rockwell Automation ControlLogix communication modules and CompactLogix controllers with two built-in Ethernet ports can be DLR supervisors.
• Managed switches - Stratix switches in DLR rings, Siemens SCALANCE switches as MRM in PROFINET rings, and industrial switches from vendors such as Phoenix Contact and Hirschmann.
• PROFINET controllers - an S7-1500 PLC with an integrated switch can itself be MRM or MRA.
• Stand-alone machines and skids - in a machine or skid with its own small ring, the supervisor is usually the switch in the machine cabinet or the controller itself.
• Not suitable - simple field devices, sensors and HMIs are usually only ring nodes.

Choose deliberately which device takes the supervisor role. A supervisor in a cabinet that is often de-energised leaves the ring unmonitored during every maintenance job.

🔧 Which parameters do you set on a DLR supervisor?

The ring status can be read via the DLR object of CIP: Normal, Ring Fault, Unexpected Loop Detected, Partial Fault or Rapid Fault/Restore Cycle. Nodes that cannot handle the beacon settings of the active supervisor report this themselves; the values then need to be relaxed.

🛠️ How do you set up the supervisor role step by step?

1. Choose the active supervisor - a central, always-powered device, preferably a controller module or managed switch. Give it the highest precedence (DLR) or the MRM role (MRP).
2. Designate a backup - a second device with a lower precedence. If the active supervisor fails, the backup takes over. In MRP you can use several MRAs instead.
3. Configure before closing the ring - enable the supervisor before the last cable closes the ring. A closed ring without an active supervisor causes a broadcast storm.
4. Avoid foreign devices in the ring - two-port devices without DLR or MRP support sometimes work, but make fault location unreliable and lengthen the recovery time.
5. Test during FAT and SAT - pull a cable at several points, check that the control system keeps running and that the supervisor reports the correct fault location.
6. Connect alarms - make a ring fault raise an alarm in SCADA, the PLC diagnostics or via SNMP traps. A ring that silently runs on the backup path is no longer redundant.
7. Document - record which device is supervisor and with which settings, and include changes in change management.

An example: on a packaging line with a ControlLogix controller, eight drives and four O stations, the Ethernet module in the main chassis becomes the active supervisor and a Stratix switch at the other end of the line the backup. On a cable break between drive 3 and drive 4 the ring switches over within a few milliseconds, the line keeps running and the supervisor reports drive 3 and drive 4 as last active nodes.

🔐 How do you secure a Ring Supervisor?

Ring protocols such as DLR and MRP have no authentication. Anyone with access to the ring network can in principle forge test frames or add a device with a higher precedence and so take over the supervisor role. That makes the supervisor a real security concern, not just an availability setting.

• Restrict configuration rights - only authorised engineers may change supervisor settings, enforced via RBAC and ACLs on the management interface, backed by physical access control.
• Contain the ring - keep the ring inside one zone in line with IEC 62443 and separate it from office networks with segmentation.
• Close unused ports - port security and physical locking prevent someone from plugging their own device into the ring.
• Monitor the status - include ring status and supervisor changes in network monitoring and forward them to a SIEM. An unexpected supervisor change or Unexpected Loop Detected is a signal to investigate.
• PRP environments - there is no supervisor there, but you still check that both networks are working; otherwise you run without redundancy without noticing.

An incorrect or unauthorised supervisor configuration can lead to loops, communication loss or a ring that no longer switches over.

❓ Frequently asked questions

What happens if the Ring Supervisor fails?

If the active Ring Supervisor fails and a backup supervisor is configured, the backup takes over the role and the ring stays monitored. Without a backup, a DLR ring falls back to an unmonitored line, so a subsequent break splits the network. A backup supervisor is therefore cheap extra assurance.

Can a DLR ring have more than one Ring Supervisor?

A DLR ring may contain several devices with the supervisor function enabled, but there is only ever one active Ring Supervisor. The precedence value determines which one, and on equal values the highest MAC address wins. The other supervisors stay in backup mode.

Is a Ring Supervisor the same as an MRP manager?

A Ring Supervisor in DLR and a Media Redundancy Manager in MRP perform the same function: blocking one port, monitoring the ring with test frames and switching over on a fault. The protocols are not interchangeable, however; a DLR supervisor cannot manage an MRP ring or vice versa, unless the device supports both protocols.

Does RSTP need a Ring Supervisor?

RSTP has no Ring Supervisor, because all bridges jointly decide via BPDUs which ports are blocked. The root bridge resembles a central role, but it does not actively monitor the ring with test frames. As a result, RSTP recovery time is less predictable than with DLR or MRP.

How fast does a Ring Supervisor switch over?

The switchover time of a Ring Supervisor depends on the protocol and its settings. DLR recovers within 3 ms with default settings on a ring of 50 nodes, while MRP guarantees 10 to 500 ms depending on the profile. Shorter beacon intervals speed up recovery but increase network load.

How do I find where the ring fault is?

An active DLR Ring Supervisor shows, per port, the last node it can still reach, so the break lies between those two devices. With the Verify Fault Location function you make the supervisor determine that location again. Devices without DLR support in the ring make this fault location less accurate.

📌 In summary

A Ring Supervisor keeps a redundant Ethernet ring loop-free, monitors it with test frames and, on a fault, switches over to the other side of the ring within milliseconds. In DLR the role is called Ring Supervisor, in MRP Media Redundancy Manager. Choose deliberately which device gets the role, configure a backup, connect ring alarms to your monitoring for high availability, and protect the configuration, because the ring protocols themselves have no authentication.