What is High Availability (HA)?
High Availability (HA) is the design principle whereby systems and networks are built so that business-critical functions remain available even when a component fails, because redundant components and automatic failover absorb the fault. Availability is expressed as the percentage of time a function works, often in “nines”: 99.99% means less than an hour of downtime per year. HA is not a product but a combination of design choices, configuration and testing.
In industrial automation, HA is essential for systems that must guarantee 24/7 production, process monitoring or safety, such as SCADA, Historian, PLC networks or MES.
🧠 How does High Availability work?
Every HA solution consists of three building blocks that must work together:
- Redundancy - duplicated hardware such as servers, power supplies, switches or firewalls, and redundant network paths (for example RSTP, MRP, PRP or HSR). No single point of failure should remain.
- Failover mechanisms - when a component fails, the system automatically switches to a working one. How fast that happens depends heavily on the mechanism: from 0 ms with parallel networks to several minutes when a virtual machine has to restart.
- Monitoring and detection - heartbeats, watchdogs and status checks notice that a component has stopped responding, trigger the switchover or automatic recovery and alert the administrator. A standby unit that has itself failed unnoticed (a latent fault) is a common cause of failed failovers.
Availability can be calculated as MTBF / (MTBF + MTTR). A higher MTBF (more reliable components) and above all a lower MTTR (faster repair) raise availability. HA reduces the effective repair time by decoupling the repair from the service: the process keeps running on the second component while the first one is replaced.
📊 How much downtime belongs to each availability level?
| Availability | Maximum downtime per year | Typical application |
|---|---|---|
| 99% | about 87.6 hours (3.65 days) | Office application without redundancy |
| 99.9% | about 8.8 hours | Single server with good backups and spare parts |
| 99.99% | about 53 minutes | Redundant SCADA server or virtualisation cluster |
| 99.999% | about 5 minutes | Redundant controller, ring network, separate power supplies |
| 99.9999% | about 32 seconds | Seamless redundancy in substations and process control |
Each additional nine requires roughly a tenfold improvement and costs disproportionately more. Set the target per function, based on a business impact analysis and the required RTO and RPO, rather than for the whole plant at once.
🔄 What is the difference between HA, fault tolerance and disaster recovery?
The terms are often used interchangeably, but they protect against different scenarios:
| Concept | Goal | Switchover | Example |
|---|---|---|---|
| High Availability | Limit a failure to a short interruption | Seconds to minutes | Failover cluster, VM restart on another host |
| Fault tolerance | No noticeable interruption | 0 ms or a few tens of ms | PRP, lockstep servers, redundant CPUs |
| Disaster Recovery | Recover after losing an entire site | Hours to days | Fallback site, backups and restore |
| Business Continuity | Keep the business running | Organisational | Manual operation, emergency procedures, crisis team |
HA protects against the failure of a component, not against ransomware, a faulty configuration change or fire: an error or infection is often faithfully synchronised to the second node. That is why backups, preferably an immutable backup, and a tested recovery plan remain necessary.
🔍 Which HA architectures exist?
| Architecture | Description |
|---|---|
| Active/Passive | One node active, the other on standby for failover (hot, warm or cold standby) |
| Active/Active | Both nodes active with load distribution; after a failure the survivor carries everything |
| Clustered HA | A group of systems shares workload and state; a quorum decides which half stays active |
| Redundant networks | PRP, HSR, MRP, RSTP or DLR for continuous data flow |
| Virtualisation with failover | VMs run on several hosts; after a host failure an HA cluster restarts them elsewhere |
In clusters, split-brain is the biggest danger: two halves that can no longer see each other both become active and write conflicting data or control the same plant. Failover clusters prevent this with a quorum: only the partition holding more than half of the votes stays active. With two nodes, a witness (a shared disk, file share or cloud storage) supplies the deciding third vote.
With virtualisation, the difference between HA and fault tolerance becomes concrete. VMware vSphere HA restarts virtual machines on another hypervisor host after a host failure; the guest operating system reboots and its in-memory state is lost. vSphere Fault Tolerance keeps a synchronised secondary VM that takes over immediately, but it has limits on the number of vCPUs and supported features.
🏭 How is HA applied in industrial automation?
- Redundant SCADA servers - a server pair with synchronised database, alarms and history; clients automatically switch to the partner
- Redundant controllers - according to Siemens, the S7-1500R typically switches over via a PROFINET ring with MRP in about 300 ms, the S7-1500H via synchronisation modules in about 50 ms; in a DCS, redundant controllers are standard
- PROFINET system redundancy - I/O devices maintain connections to two controllers: S2 (one interface, two connections) is the most widely used, while R1 and R2 use two interface modules and so also protect against the loss of an interface or an entire network
- Redundant communication - via ring redundancy, DLR and PROFINET media rings, or seamlessly with PRP and HSR in substations
- Data logging - via Historian clusters or a replicated time series database, with local buffering in edge devices so that no data is lost during an outage
- Network security - OT firewalls and routers in active/passive configuration with synchronised session tables
- Power supply - dual power supplies on separate circuits, a UPS and possibly a standby generator
Relevant sectors include power plants, water treatment, chemicals, food, pharma, and tunnel and rail technology.
HA for availability is not the same as redundancy for safety. In an SIS, what matters is that the safety function works on demand; functional safety under IEC 61508 and IEC 61511 uses hardware fault tolerance and voting such as 1oo2 or 2oo3 in a safety PLC for that purpose.
🧭 How do you implement High Availability step by step?
- Identify the critical functions - which processes must not stop, and what does an hour of downtime cost?
- Set targets - availability, maximum switchover time, RTO and RPO per function.
- Look for single points of failure - servers, controllers, switches and power supplies, but also licence servers, DNS, time synchronisation and the cabinet or cable tray everything runs through.
- Limit common cause failures - separate power supplies, cable routes and rooms; two nodes in the same rack die together in a single fire or surge.
- Choose the mechanism - matching the permitted switchover time: PRP/HSR (0 ms), MRP (200 ms by default), controller redundancy (tens to hundreds of ms), cluster failover (seconds to minutes).
- Test failover periodically - pull a cable or switch off a node in a planned maintenance window; an HA setup that has never been tested is an assumption.
- Manage both halves equally - patch management and change management must keep both nodes in the same state, so that the standby works when it is needed.
In the Netherlands and the EU, availability is also a legal obligation. NIS2 Article 21 requires business continuity, such as backup management and disaster recovery, and crisis management. The Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, transposes this duty of care into Dutch law for essential and important entities.
🔐 Which security aspects apply to HA?
- Redundancy increases availability, but also requires duplicated access control and patch management
- Monitoring and anomaly detection must cover both nodes
- Backup and restore procedures must work in mirrored systems
- Audit trails must log both systems
- Failover must not create a security gap (such as automatically opened connections or default passwords on the standby)
- Synchronisation and heartbeat links belong in their own protected segment, in line with network segmentation
In IEC 62443-3-3, availability falls under Foundational Requirement 7 (Resource availability), including SR 7.1 denial-of-service protection, SR 7.3 control system backup, SR 7.4 control system recovery and reconstitution and SR 7.5 emergency power. SR 7.1 requires a system to keep operating in a degraded mode or maintain its essential functions during a DoS event. Redundancy does not help against an attack that hits both halves at once.
HA is not a substitute for security, but should be integrated with it.
❓ Frequently asked questions
What does 99.99% availability mean?
An availability of 99.99% means a system may be unavailable for at most about 53 minutes per year. At 99.9% that is about 8.8 hours, and at 99.999% about 5 minutes. For High Availability in OT, the target is set per critical function.
Is High Availability the same as redundancy?
High Availability is the goal, and redundancy is the main means of achieving it. Redundancy without automatic detection and failover does not yet deliver HA, because someone has to switch over manually. HA therefore combines redundancy, failover, monitoring and regular testing.
What is the difference between active/passive and active/active?
In active/passive, one node handles all the work and a standby node takes over after a failure. In active/active, both nodes work simultaneously and share the load, so no switchover is needed after a failure, but capacity is lost. Active/passive is the usual approach in OT, for example for SCADA servers and controllers.
What is split-brain in an HA cluster?
Split-brain occurs when the nodes of a High Availability cluster can no longer see each other and both believe they are the active node. This can lead to conflicting data or double control of a plant. A quorum with a witness ensures that only one half stays active.
Does High Availability protect against ransomware?
High Availability protects against component failure, not against ransomware. Encrypted or corrupted data is usually replicated straight to the second node. Protection against ransomware requires segmentation, offline or immutable backups and a tested disaster recovery plan.
What does IEC 62443 require regarding availability?
IEC 62443-3-3 covers availability in Foundational Requirement 7, Resource availability. It contains requirements for denial-of-service protection, resource management, backup, recovery, emergency power, configuration settings, least functionality and a component inventory. High Availability measures help meet these requirements.
📌 In summary
High Availability keeps critical OT and IT functions available by combining redundancy, automatic failover and monitoring, so that the failure of a single component does not stop the process. Set the availability target and switchover time per function, eliminate single points of failure and split-brain, test failover regularly and complement HA with backups and disaster recovery, because HA does not protect against ransomware or configuration errors.