Ring Redundancy

What is Ring Redundancy?

Ring redundancy is a network design in which switches or devices are connected in a closed ring and a redundancy protocol ensures that, when a cable breaks or a node fails, traffic automatically continues through the other side of the ring. In normal operation one link in the ring is logically blocked so that no loop exists; on a failure that link is released. Rings are a widely used form of network redundancy in industrial automation, because they deliver high availability with very little extra cabling.

A ring protects against one failure. After the first cable break the ring has become a line, and a second break splits the network into two parts.

🧠 How does ring redundancy work?

A physical ring is actually a fault in Ethernet: frames have no hop limit, so a broadcast would circulate forever. Every ring protocol solves this in the same way.

1. Close the ring - each device has two ring ports; the last switch is connected back to the first, creating a closed topology.
2. Block one port - a manager or ring supervisor keeps one ring port logically closed. The network then behaves like a line without a loop.
3. Supervise the ring - the manager periodically sends test frames in both directions. If they return on the other side, the ring is intact. Switches also report a lost link immediately.
4. Switch over - if the manager misses its test frames or receives a link-down notification, it opens the blocked port and tells all switches to flush their MAC address tables, so traffic takes the new path.
5. Revert - once the fault is repaired, the manager blocks the port again. Some protocols deliberately wait before doing so; ERPS uses a default wait-to-restore time of five minutes, so that a loose connector does not make the ring flap.

A few frames are lost during step 4. The recovery time (recovery) determines whether the control system notices. Seamless protocols such as HSR avoid this by sending every frame in both directions.

🔍 Which ring protocols exist?

PRP is deliberately not listed here as a ring protocol: PRP sends every frame over two separate, parallel networks, each of which may have its own topology, including a ring. It provides seamless redundancy, but it is not ring redundancy as such.

🔄 What is the difference between switchover and seamless redundancy?

Ring protocols fall into two families. The difference determines which applications you can protect with them.

PROFINET also offers MRPD (Media Redundancy for Planned Duplication), in which IRT frames are sent over both sides of an MRP ring at the same time. This combines the simplicity of MRP with seamless recovery for motion control.

🏭 Where is ring redundancy used?

• Production lines - a ring of managed switches along a line connects PLCs, HMIs, O, sensors and actuators. A cable cut by a forklift then does not stop the line.
• Process plants - rings connect control cabinets across different parts of a site, often over fibre because of distance and electromagnetic interference.
• Digital substations - in IEC 61850 substations, HSR rings and PRP networks are common because protection relays exchanging GOOSE messages must not see any interruption.
• Infrastructure - tunnels, locks, pumping stations and traffic systems use fibre rings along the route, so that a single excavation incident does not cut all outstations off from the SCADA control centre.
• Cell and area level - in the Purdue Model, rings sit mainly at levels 0 to 2 (field, basic control and supervisory). The Converged Plantwide Ethernet reference design calls this the cell/area zone.

🔧 How do you design a reliable ring?

A ring is quick to build, but its availability depends on the details. This approach avoids the well-known pitfalls:

1. Match the protocol to the control system - PROFINET installations use MRP, EtherNet/IP installations use DLR. Do not mix two ring protocols on the same ring ports, and disable RSTP on ports already managed by MRP or DLR.
2. Respect the ring size - the 200 ms MRP profile applies to a maximum of 50 devices, the 10 ms profile to a maximum of 14. Split larger networks into several coupled rings; since its 2016 edition, IEC 62439-2 describes MRP Interconnection for this, with two redundant links between rings.
3. Tune the watchdog - a PROFINET IO device reports a communication fault if it receives no data within its watchdog time. With the 200 ms MRP profile, that watchdog must therefore be longer than 200 ms.
4. Separate the cable routes - a ring whose two sides run through the same cable tray still fails completely after one fire or excavation incident. Physical route diversity matters as much as the protocol.
5. Monitor the ring status - because an open ring keeps working, nobody notices the first failure. Have the manager raise an alarm via SNMP traps or a diagnostic message in the control system, and include “ring open” in your network monitoring.
6. Test the switchover - during the FAT and the SAT, unplug a ring cable at several points and check that the control system reports no fault. Repeat after every major change.

Rule of thumb: design the ring so that its recovery time is well within the timeout of the slowest critical connection, and document which switch is the manager.

🔐 How do you secure a redundant ring?

Ring redundancy is about availability, and availability is the primary security objective in OT. IEC 62443 covers it under resource availability (FR 7) in IEC 62443-3-3, and the Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, requires essential and important entities to safeguard the continuity of their network and information systems.

• Loops and broadcast storms - a ring without a working redundancy protocol is a loop. A wrong configuration, a replacement switch with factory settings or a second manager can bring down the whole segment.
• Protect the configuration - restrict management access to ring switches with RBAC and ACLs, and use physical access control for management ports.
• Keep out unauthorised devices - apply port security on access ports, so nobody with a laptop can add a second loop or a rogue manager.
• Segment - the ring is a single layer 2 domain. Divide it logically with VLANs and QoS, and separate the ring from other zones with a firewall following network segmentation principles; this is basic security hygiene.
• Detect - forward ring events and link changes to a SIEM, so that an unexpected switchover is investigated as a possible fault or sabotage.
• Control changes - record ring changes through change management; an uncontrolled modification can cause a network loop or downtime.

❓ Frequently asked questions

How many failures can a redundant ring survive?

A redundant ring survives exactly one failure, such as a single cable break or one failed switch. A second failure splits the network into two separate parts. That is why the first failure must trigger an alarm immediately and be repaired quickly.

Is RSTP suitable for ring redundancy?

RSTP can keep a ring loop-free, but its recovery time is not guaranteed and increases with the number of switches in the ring. For control traffic with short timeouts, MRP or DLR are better suited, because they have a fixed maximum recovery time for a given ring size. RSTP remains useful for mixed networks and less time-critical connections.

What is the difference between MRP and DLR?

MRP (IEC 62439-2) is the ring protocol of PROFINET and recovers within 10 to 500 ms depending on its class. DLR is the ring protocol of EtherNet/IP and recovers a 50-node ring in about 3 ms, because the supervisor sends beacons every 400 µs. Both block one port and open it when a failure occurs.

When should you choose HSR or PRP instead of an MRP ring?

You choose HSR or PRP when even a few milliseconds of frame loss is unacceptable, as with protection relays in IEC 61850 substations. Both protocols send every frame twice, so the recovery time is zero. The trade-off is more expensive equipment and a higher network load.

Can you mix switches from different vendors in one ring?

With standardised protocols such as MRP, HSR or ERPS, switches from different vendors can work together in one ring, provided they support the same roles and recovery time class. Vendor rings such as Turbo Ring or HIPER-Ring only work with that vendor’s equipment. Always test the combination before going into production.

Why monitor a ring if it heals itself?

A ring heals itself so well that a cable break often goes unnoticed, while the redundancy is already used up. Monitoring via SNMP or the control system shows that the ring is open, so you can repair it before a second failure stops the installation.

📌 In summary

Ring redundancy keeps an industrial network available by connecting switches in a closed ring and automatically using the other side of the ring when a failure occurs. Match the protocol to the control system (MRP for PROFINET, DLR for EtherNet/IP, HSR or PRP where no frame may be lost), respect the ring size, separate the cable routes and monitor the ring status, because a ring only protects against a single failure.