In short. Redundant controllers protect against a controller failure, but only if the switchover is bumpless, the standby is truly independent and the rest of the chain, such as power supplies, networks and I/O, is also redundant where it matters. A redundant PLC on a single power supply is not redundant.
Redundancy patterns
| Pattern | Description | Watch for |
|---|---|---|
| Cold standby | Spare controller manually loaded | Long recovery time |
| Warm standby | Standby follows but needs a short takeover | Brief interruption |
| Hot standby | Standby runs in step, takes over within a scan | Synchronisation faults, shared failures |
| Distributed control | Each unit has its own controller; no single master | Coordination between peers |
What must be duplicated
- Controller and its memory synchronisation link.
- Power supplies, from independent sources.
- Communication networks, using separate switches and routes.
- Critical I/O, such as breaker status and commands.
- Operator interface path to the plant.
Bumpless switchover
At changeover, outputs should hold state, not reset. Sequences in progress should continue or move to a safe step. Test switchover during a running sequence, not only at idle.
Common-cause failures
- Both controllers in one cabinet with a shared supply or heat source.
- Same software fault in both controllers.
- One network cable or switch carrying both paths.
- One maintenance error affecting both.
See single-point-of-failure analysis.
Fall-back when all controllers fail
Define what the plant does with no PLC: local automatic control, manual operation or safe shutdown. See degraded modes.
Illustrative example
A hospital plant uses a hot-standby PLC pair on separate supplies with two ring networks. A test pulls power from the primary controller while a load-restoration sequence is in step three. The standby takes over and completes the sequence without any breaker moving unexpectedly. A second test removes one network switch; the plant continues on the other ring and raises an alarm.
Redundancy options
| Architecture | How it works | Failover behaviour |
|---|---|---|
| Cold standby | Spare CPU, switched manually | Minutes, manual |
| Warm standby | Spare CPU running, not synchronised | Seconds, some state lost |
| Hot standby | Spare CPU synchronised every scan | Bumpless, typically under 100 ms |
| Dual independent controllers | Each controls a separate half of the plant | Half the plant is affected on failure |
What must be redundant
- CPUs.
- Power supplies, fed from separate DC or UPS sources.
- Network paths with ring or dual-path topology.
- Critical I/O and sensors.
A redundant CPU with a single power supply is not redundant. Check every dependency on the chain.
Common-mode failures
- Same software fault in both CPUs after an update.
- Both controllers in the same cabinet, taken out by fire, water or heat.
- One shared network switch.
Availability illustration
If a single PLC is 99.9 percent available, two truly independent PLCs in hot standby give a theoretical 99.9999 percent. In practice the figure is lower because of common-mode causes and failover faults, which is why testing matters.
Test regime
Pull a CPU, a power supply and a network cable during FAT and periodically afterwards. See degraded modes.
The master engineering question
If any single component in the control chain fails during a critical sequence, does the sequence still complete, and how would we know the redundancy has been lost?
What to send us
Send availability targets and current control architecture. Send your application details.
Questions engineers ask
Is hot standby always needed?
Only where a control outage is unacceptable. Many plants are fine with good local fall-back.
How do I detect lost redundancy?
Alarm on any single path or unit running alone.
Can software be redundant?
Different versions or independent logic reduce common faults but add complexity.
How often should switchover be tested?
Regularly, under defined conditions and safe procedures.
This guide gives general principles. Redundancy needs a project-specific design.