Replacing a Failed Compact GuardLogix 5370: Signature, SNN, Firmware, I/O Ownership and the Path to 5380

Replacing a failed Compact GuardLogix 5370 (1769-L30ERMS, 1769-L33ERMS, 1769-L36ERMS, 1769-L37ERMS, 1769-L38ERMS) with the same catalog number is more than plugging it in and downloading. The new controller must receive the validated project with the right firmware, the same safety task signature, the same Safety Network Number (SNN) and the same safety-lock state; then the CIP Safety I/O devices must reconnect to the right owner. If the signature is deleted during the swap, Rockwell's documentation requires the system to be retested and revalidated (1769-UM022E pp. 132, 140).

This article collects those requirements from the 1769-UM022E user manual and the 1756-RM099H safety reference manual, with the lifecycle of the 1769-L3xERMS family and the path to Compact GuardLogix 5380. It does not replace those documents and does not tell anyone how to change safety code.

SIL/PL levels and safety values must be determined by a competent engineer per ISO 13849-1 / IEC 62061 for each machine.

1769-L3xERMS lifecycle and replacements

Per Rockwell's product pages (read 27 October 2026):

Memory in brackets is standard / safety memory as named on the product page. Every replacement is an "Engineering Replacement": the change needs engineering work, it is not a direct swap. The Armor (IP67, on-machine) controllers have no replacement. Other catalog numbers are in the end-of-life lookup.

What must stay right in a like-for-like swap

Safety task signature

The signature is an ID number, date and time that identifies the whole safety portion of the project: logic, data and configuration (1769-UM022E p. 12). The safety reference manual requires recording the signature when it is created and checking it after every download (1756-RM099H pp. 42, 44). A download without a safety task signature means the application has to be tested again; with a matching signature that step is not demanded (1756-RM099H p. 44).

Before removing the failed controller, have at hand the validated project file with its signature and the signature record (ID, date, time) in the machine's safety file. The "Copy" button on the "Safety" tab puts these three values on the clipboard for the record (1769-UM022E p. 132).

Firmware that matches the project

A new controller needs firmware loaded before use, by ControlFLASH, by AutoFlash during download, or from a 1784-SD1/SD2 memory card (1769-UM022E p. 29). If a firmware update is interrupted, the firmware reverts to the out-of-box 1.xxx revision (pp. 29, 32).

When controller firmware and project revision differ, Logix Designer offers two choices: update the controller to match the project, or update the project to the controller's revision. Updating the project deletes the signature and the system requires revalidation (p. 140). If only the minor revision differs, keeping the signature requires flashing the controller to exactly the project's revision before downloading (p. 142). Logix Designer updates firmware as part of a download only when the controller is safety-unlocked (p. 139).

The 1756-RM099H checklist also requires using only the hardware and firmware releases that Rockwell lists for safety use on its certification page (p. 72).

Safety-lock and passwords

Safety-lock protects the safety portion: no editing, no forcing safety I/O, no changing inhibit states, no generating or deleting the signature (1769-UM022E p. 129). The lock and unlock passwords are optional, 1–40 characters and not case-sensitive (p. 40). The lock state cannot be changed with the keyswitch in RUN (p. 129).

On download, a safety-locked controller accepts only a project with a matching signature (1756-RM099H p. 44). After a successful download, the controller's lock state and signature match the downloaded project (1769-UM022E p. 142). The user is responsible for access control, including password handling (1756-RM099H p. 9); the 5380 safety reference manual states that Rockwell provides no password override service (1756-RM012J p. 73). Passwords therefore belong in the machine's records, not in one person's memory.

Controller Safety Network Number

The SNN identifies each safety subnet; every CIP Safety device must be configured with that subnet's SNN (1769-UM022E p. 12). Changing the SNN requires unlocking and deleting the signature first (p. 48), which means revalidation (p. 132). Because the SNN is stored in the project (p. 48), a replacement controller for the same machine, with the old controller removed, normally takes the project with its existing SNN.

Do not confuse this with copying a project to different hardware or another location to run within the same routable CIP Safety system: then every SNN must be changed, because SNN values must not be repeated (1756-RM099H p. 28).

Serial number and Project to Controller Match

If the project has "Project to Controller Match" enabled, Logix Designer compares the serial number in the project with the new controller and reports a mismatch. Select "Update project serial number" only after confirming you are connected to the correct controller (1769-UM022E pp. 139, 142).

The old SD card

A memory card can load the project and firmware at power-up, depending on whether "Load Image" is "On Power Up" or "On Uninitialized Memory" (1769-UM022E p. 160). A load needs a matching controller type and matching major and minor revisions (p. 159). Note that a card can hold a project older than the one running (p. 25). After a user-initiated load (with the controller unlocked), the lock state, passwords and signature take the card's values; with "On Power Up" the card's project loads at every power-up, even on a safety-locked controller (p. 160). The signature still has to be checked against the record (1756-RM012J p. 73).

CIP Safety I/O: SNN and ownership

Each CIP Safety I/O device is owned by exactly one controller, which stores the device's configuration (1756-RM099H p. 22). An out-of-box device has no SNN; the SNN is set when the owning controller sends the configuration (p. 28).

• See the owner. Online, the "Safety" tab of "Module Properties" shows "Local" when the open project owns the device, or "Remote" with the SNN and address of the owning controller (1769-UM022E p. 91).
• Reset Ownership returns the device to out-of-box condition. It is not possible with pending edits, when a safety task signature exists, or when safety-locked (p. 91). If the connection is "Local", "Inhibit Connection" first (p. 93); inhibiting is also blocked when locked or when a signature exists (1756-RM099H p. 46). Deleting the signature to do this means retesting and revalidating (1769-UM022E p. 132).
• Replacing the I/O device itself. The "Configure Only When No Safety Signature Exists" or "Configure Always" option on the controller's "Safety" tab decides how a replacement device is accepted (p. 43). In "Configure Only When No Safety Signature Exists" mode with a signature present, a new out-of-box device needs its SNN "Set" manually; before clicking "Yes", confirm the NS indicator flashes red/green on the right device (pp. 95–96). Rockwell allows "Configure Always" only when no part of the CIP Safety system is relied on for the safety function while a device is replaced and functionally tested (pp. 43, 100; 1756-RM099H p. 24).

Checks after the swap

The steps below are the checks required in 1756-RM099H and 1769-UM022E, not a validation procedure. The validation procedure belongs to whoever is responsible for the machine's safety.

1. Compare the safety task signature in the controller with the recorded one (1756-RM099H pp. 42, 72). A steady green "SFTY RUN" indicator means a signature is present, flashing means none (1769-UM022E p. 164); status indicators are not to be used to confirm safety functions (1756-RM099H p. 17).
2. Look at the "Safety Status" button on the online bar and the "Safety" tab of "Controller Properties": lock state, signature, and a safety status of "Safety Task OK" (1769-UM022E pp. 146, 148). Check each module's safety connection through the RunMode and ConnectionFaulted bits (p. 147).
3. Confirm the project as the safety manual describes: upload, save under a new name, and use "Program Compare" on controller properties, CIP Safety I/O, safety task and safety logic (1756-RM099H p. 43).
4. If the signature was deleted or the project revision changed, repeat the project verification test: toggle every sensor and actuator in every safety function and test all shutdown functions (1756-RM099H pp. 42–43).
5. For a replaced safety I/O device, the manual requires testing the device and the system to your company's procedures before returning to service (1769-UM022E pp. 96, 99, 100). For the controller, the test scope is decided by whoever is responsible for the machine's safety.
6. Store the project to the memory card again; the store also writes the firmware to the card, and "Program (Remote Only)" is the recommended load mode (1769-UM022E pp. 157–158).

The failed controller can be returned to Rockwell through the distributor so the failure is logged and analysed (1756-RM099H p. 14).

Path to Compact GuardLogix 5380

The replacements Rockwell lists for 1769-L3xERMS are 5069-L3xxERMS3 controllers. Compact GuardLogix 5380 has two groups of catalog numbers: ending in S2 (for example 5069-L320ERS2) and ending in S3 (for example 5069-L320ERMS3). Rockwell rates the S2 controllers for use up to SIL 2/PLd and the S3 controllers up to SIL 3/PLe (5069-UM001N p. 47; 1756-RM012J p. 24). Which group fits is the safety engineer's decision from the machine's risk assessment.

What changes on the move to 5380:

• Software. S3 controllers need Logix Designer v32 or later, S2 v31 or later (5069-UM001N p. 13).
• Local I/O. The 5380 rack uses Compact 5000 I/O modules (5069-UM001N p. 21; 1756-RM012J p. 25), not the 1769 modules beside the 5370. The 24 V DC supplies for MOD and SA power must be SELV/PELV-listed (1756-RM012J p. 25).
• SNN. A 5380 has up to three SNNs: two Ethernet ports and the backplane; Dual-IP mode needs one per port (5069-UM001N pp. 47–48). Changing controller type or IP mode generates new time-based SNNs (1756-RM012J p. 45), so the SNNs of the running I/O devices must be handled per the manual.
• Signature. A project created from an imported project with an existing signature shows "unknown" (gray) signatures, which cannot be used for certification (1756-RM012J p. 20). For upgrades the manual requires an impact analysis, a review of firmware release notes and PCDC compatibility, and removing and regenerating the signature; the Safety Signature report shows which elements changed and need revalidation (p. 70).

For standard (non-safety) CompactLogix, see CompactLogix 1769-L31/L32E/L35E end of life.

A TDL case

In 2025–2026 TDL pre-configured a replacement Compact GuardLogix 5370 with the existing standard and safety program for the Sky Drop ride at Mega Grand World Hanoi and supported the site team remotely during the swap. Details: Sky Drop project.

Need an engineer for a controller swap: send a request.