Redundancy

What is redundancy?

Redundancy is the deliberate duplication (or multiplication) of critical components, connections or functions so that a system keeps working, or stays safe, when one part fails. In industrial automation, IT and OT environments this means dual power supplies, controllers, network paths, servers and sensors. Redundancy is not a goal in itself: it is a means to raise availability or safety, and which of the two you gain depends on how the extra components are wired and voted.

Redundancy removes a single point of failure, but every extra component is also one more part that can fail, has to be managed and must keep being tested.

🧠 Why is redundancy important?

A continuous process, such as a water treatment works, a chemical plant or a power grid, cannot simply be restarted. A failed controller or switch there means lost production, an unsafe process state or the loss of an essential service. Redundancy helps with:

• Availability - the process keeps running through a hardware, network or power failure
• Process safety - a safety function keeps working if one sensor or channel fails (required by IEC 61511 from a certain SIL upwards)
• Maintenance without downtime - replace or update one half while the other controls the process
• Continuity and Compliance - part of Business Continuity and Disaster Recovery, and of the duty of care under NIS2

🧱 What types of redundancy are there?

Data redundancy is not the same as a backup. Replication and RAID copy an error, a deletion or a ransomware encryption straight to the second copy. Only a disconnected or immutable backup protects against that.

⚙️ Which redundancy architectures exist?

Capacity is also often expressed in N notation. N is what is needed to run the process. N+1 means one spare unit on top (for example three pumps where two are needed), 2N means a complete second, independent system. Data centres use this language in the Uptime Institute Tier classification: Tier III is concurrently maintainable (any component can be taken out for maintenance without an outage), Tier IV is fault tolerant (any single failure does not cause an outage).

🔐 What does redundancy mean in safety systems?

In a SIS the question is not production availability but whether the safety function works when it is demanded. IEC 61508 and IEC 61511 use the concepts of hardware fault tolerance (HFT) and MooN voting (M out of N). An HFT of 1 means that one dangerous failure does not yet cause loss of the function; only the second one does.

IEC 61511-1 (2016 edition) sets a minimum HFT per SIL: 0 for SIL 1, 0 for SIL 2 in low demand and 1 in high demand, 1 for SIL 3 and 2 for SIL 4. A safety PLC often meets these requirements with internal dual processors; in the field it means duplicate sensors or actuators with voting logic. More background is in functional safety.

🏭 How is redundancy applied in OT?

Concrete examples from practice:

• Redundant controllers - Siemens S7-1500R/H: the R variant couples the CPU pair over a PROFINET ring with MRP (CPUs up to about 100 m apart, switchover around 300 ms), the H variant uses synchronisation modules and fibre optics (up to 40 km, switchover around 50 ms). With ControlLogix, redundancy modules (1756-RM2 or the newer 1756-RM3) link two chassis.
• Redundant SCADA servers - a primary and secondary server with a synchronised alarm and tag database; clients switch over automatically.
• DCS architectures - traditionally built redundant: dual controllers, dual networks and dual I/O communication.
• Networks - ring redundancy with MRP (200 ms standard recovery under IEC 62439-2), or PRP and HSR from IEC 62439-3 with zero recovery time, for example in substations.
• Servers and virtualisation - virtualised SCADA and historian servers on a cluster with automatic restart on another host.
• Network separation - a redundant firewall pair in active/passive configuration, and dual VLAN trunks between core switches.

Redundancy is also a cybersecurity topic. Foundational Requirement 7 (Resource availability) of IEC 62443-3-3 covers, among other things, denial-of-service protection, backup, recovery and emergency power. At the same time a redundancy component can itself be vulnerable: in January 2026 Rockwell reported a DoS vulnerability (CVE-2025-14027) in the 1756-RM2 module, for which no firmware fix exists and an upgrade to the 1756-RM3 is recommended. Moreover, an attack that hits both halves at once is not absorbed by redundancy.

🔧 How do you approach redundancy step by step?

1. Determine criticality - which functions lead to danger, environmental damage or loss of an essential service when they fail? A BIA and the required RTO give direction.
2. Find single points of failure - walk through power, controllers, network, servers, time synchronisation and people (one engineer holding all the knowledge).
3. Choose the goal per function - availability (2oo2, hot standby) or safety (1oo2, 2oo3), and the acceptable switchover time.
4. Calculate the effect - the availability of a single component is MTBF / (MTBF + MTTR). With an MTBF of 50,000 hours and an MTTR of 8 hours that is 99.984%. Two independent units in parallel theoretically exceed 99.9999%, but only if the switchover works and there is no common cause.
5. Limit common cause failures - separate power supplies, cable routes, cabinets and firmware versions. IEC 61508-6 quantifies this with a beta factor, typically between 0.5% and 10% of the failure rate.
6. Test the switchover periodically - a standby that has never been tested tends to fail exactly when it is needed. Also watch the standby with monitoring, otherwise you only discover a broken standby at the second failure.

As an indication of what availability percentages mean per year (8,760 hours):

In the Dutch context, the Cyberbeveiligingswet (Cybersecurity Act, in force since 15 August 2026), which implements NIS2, requires measures for business continuity, backup management and crisis management. For digital infrastructure and digital services, such as cloud and data centre providers and managed service providers, Implementing Regulation (EU) 2024/2690 spells this out with explicit requirements for backup and redundancy management. In validated pharmaceutical environments following GAMP, a change to a redundant configuration must also be validated and documented.

🔄 What is the difference between redundancy and high availability?

Redundancy is the building block; high availability is the outcome you want to achieve with it. HA combines redundancy with fault detection, automatic switchover, monitoring and tested procedures. Two servers without a failover mechanism are redundant, but not highly available.

❓ Frequently asked questions

Is redundancy the same as a backup?

No, redundancy keeps a system running through a failure, while a backup makes data recoverable after loss or corruption. Redundant copies replicate errors and ransomware encryption immediately. That is why you need both: redundancy for continuity and a separate backup for recovery.

Does redundancy always make a system safer?

No, redundancy can raise availability or safety, but not automatically both. A 2oo2 arrangement prevents spurious trips but tolerates no dangerous failure at all, while 1oo2 is safer but stops the process unnecessarily more often. A 2oo3 arrangement combines both benefits at a higher cost.

What is a common cause failure in redundancy?

A common cause failure is a single cause that takes out both redundant units at the same time, such as a shared power supply, the same firmware bug, a fire in one cabinet or a cyberattack. Such a failure makes the redundancy worthless. You reduce the risk through physical separation, diversity of components and separate power supplies.

What does N+1 redundancy mean?

N+1 redundancy means there is one more unit than needed to keep the process running. With three pumps where two are needed, one can fail or be under maintenance without capacity falling short. 2N means a complete second, independent system.

How fast does a redundant PLC switch over?

The switchover time of a redundant PLC depends on the platform and the synchronisation method: from tens of milliseconds for hot standby with fibre-optic synchronisation to a few hundred milliseconds for synchronisation over the network. Siemens quotes about 50 ms for the S7-1500H and about 300 ms for the S7-1500R. Always check whether the process can tolerate that interruption.

How often should you test a redundant switchover?

You should test a redundant switchover periodically, for example during planned shutdowns or after every firmware or configuration change. Safety functions have a fixed proof-test interval derived from the SIL calculation. Without a test you do not know whether the standby will actually take over.

📌 In summary

Redundancy duplicates power supplies, controllers, networks, servers and sensors so that a single failure does not stop the process or make it unsafe. The chosen architecture (hot, warm or cold standby, N+1 or 2N, 1oo2 or 2oo3) determines whether you mainly gain availability or safety. Common cause failures, untested switchovers and the difference from backups decide whether the investment pays off in practice.

Redundancy is the deliberate duplication of systems or paths to safeguard continuity, safety and reliability, but it only works when the standby is independent, monitored and tested.