PLC Redundancy: What to Ask Before You Buy a Second Controller

A PLC is the controller that runs the machine. Redundancy means a backup so one failure does not stop it. Vendors sell that as a single checkbox. On a real machine it is several different products, and each one survives a different failure. A loop of network cable is one product. A hot-standby controller — a second processor already running, ready to take over without someone swapping hardware — is another. A second rack of inputs and outputs, the sensors and devices the controller turns on and off, is a third. None of those is a safety PLC, which is a controller certified to stop the machine safely. Staying online and stopping safely are different jobs. Plants pay for all three and get the uptime of whichever one they forgot.

How to read this Written for machine builders and plant teams choosing or inheriting a controller brand. Catalog numbers, software versions, and which input/output modules are allowed all change. Confirm the current manual and the vendor’s supported-module list for the exact processor you intend to buy. The takeover times below are vendor claims or rough engineering ranges. Measure them on the program you will actually run. The dollar figures are not quotes. The local distributor sets the price. What repeats from project to project is the shape of the cost.

Buy the backup that matches the failure you cannot afford. A second controller is the expensive one, and it is often not the part that fails.

Four different things people call redundancy

Before comparing brands, separate the layers. They have different prices and they fail differently.

1. A backup network cable. A ring, or a second cable, so one broken wire or one port does not knock out every device. Rockwell calls its cable loop Device Level Ring (DLR). Siemens calls its version MRP, the Media Redundancy Protocol. B&R uses a POWERLINK ring or a second POWERLINK cable. POWERLINK is B&R’s machine network. Beckhoff and CODESYS use EtherCAT cable redundancy. EtherCAT is the network those controllers use to reach drives and remote inputs. This is usually the cheapest layer, and it is the one most standalone machines actually need.
2. A backup power supply. A second 24-volt supply, a module that lets either supply feed the panel, and sometimes a battery backup on the controller. That survives a dead supply. It does not survive a bad processor or a bad program.
3. A backup controller. Two processors kept in step. One is running the machine. The other is the hot standby, already loaded and waiting. On a qualifying fault the standby takes over and keeps the inputs and outputs. This is a Rockwell ControlLogix pair of racks, a Siemens S7-1500R or S7-1500H pair, a B&R pair of ordinary X20 controllers, CODESYS Redundancy, and Schneider’s M580 Hot Standby. Siemens uses the letter R for its redundant pair and the letter H for a separate high-availability family. Those are two different products, explained below. This is the layer with the real engineering cost.
4. Backup inputs, outputs, and devices. The remote rack, the network card in that rack, or the drive can also fail. Siemens splits this into three grades. S1 is an ordinary device with one connection to one controller. S2 is one network card with two connections, one to each controller in the pair. R1 is two network cards on two separate networks, so one card or one whole network can die and the device stays up. Rockwell’s version of S2 is a connection both controllers can own. A plain adapter sitting on a DLR cable loop is not that. If the device cannot be owned by both controllers, the processor pair does nothing useful when that adapter fails.

A fifth category is a spare on the shelf. A spare processor in the storeroom, or a second controller loaded with the same program that an electrician swaps during a shutdown. That is a spare-parts plan. It is honest and often the right answer. It is not hot standby. Do not draw it on the architecture slide as if the machine will ride through the failure by itself.

What each platform actually fails over

Rockwell: a second rack, not a second CompactLogix

Rockwell’s real backup-controller product is a pair of ControlLogix racks. Each rack carries a controller, at least one communication module, and a redundancy module. The modules match. The firmware, the built-in software version, matches. The primary runs the process. The secondary stays in step over fiber. A qualifying fault — the controller, the power, or a supported communication failure — switches the pair. Rockwell’s own brochure puts ControlLogix takeover in the “greater than about 20 ms” class. A supervised CompactLogix hot-backup technique, a slower and narrower pattern, sits in a “greater than about 250 ms” class. Treat both as floors and as marketing tables, not as a guarantee for your program. The size of the copy between processors, how the program is split into tasks, and the number of input and output connections all move the number. Measure it on the real project, under load, with the operator screen and the drives attached. The operator screen is the HMI.

A few limits that show up late if nobody asks:

• CompactLogix is not this product. There is no 1756 redundancy module on a 5370 or 5380. Two CompactLogix controllers messaging each other, or a DLR cable loop of POINT or Flex inputs and outputs, is not a pair that switches without a bump in the machine. Rockwell has a limited hot-backup pattern for CompactLogix. It is not a catalog feature you download and ship without supervision.
• DLR is only a backup cable. It survives one break in the ring. It does not replace the processor.
• Not every Logix feature is allowed on a redundant project. Motion, some controller-to-controller data layouts, and some module families are restricted or simply unsupported. Read the supported-feature table in the current redundancy manual (1756-UM015 for current systems, and the older 1756-UM535 material still sitting in plants) before you promise a redundant Kinetix cell. Kinetix is Rockwell’s servo-drive family.
• A 5590 does not drop onto an older RM2 design. Rockwell’s current process-redundancy overview calls for a 1756-RM3 with ControlLogix 5590. Do not copy a 5580 parts list that used an RM2 without checking.
• Edits while the machine is running, and how the operator screen finds the controller, are part of the product on a real ControlLogix pair. The secondary receives the edit. The EtherNet/IP address behavior is defined so nobody rewrites the screen by hand at 2 a.m. That is a reason plants pay for it. It is also why the first startup week is longer than a download to a single controller.

The cost shape is two of the expensive parts: two racks, two processors, two redundancy modules, fiber, and a matched set of EtherNet/IP modules. Budget the controller hardware near 2× a single ControlLogix, plus the fiber and the second rack, before you add backup adapters in the field. Engineering is not 2× if the team has done a pair before. It is often more than 2× the first time, because unsupported instructions and takeover tests eat the schedule. Spares have to be the same family. A “spare” processor of a different memory size is not a spare.

Siemens: R and H are two different products

Siemens is the brand where the catalog forces the question. Both the S7-1500R and the S7-1500H are pairs of processors, programmed in STEP 7. The R is the redundant pair. The H is a separate high-availability family. They do not fail the same way, and they do not cost the same.

S7-1500R, the redundant pair

The R processors (the 1513R, 1515R, and 1517R classes) sit in a PROFINET ring that uses MRP, Siemens’s cable-loop method. That ring is also how the two processors stay in step. Every device in the ring has to speak MRP. Devices that do not sit behind a switch, off the ring. The “stay in step” traffic and the input/output traffic share the wire, so a noisy or oversized ring is a backup problem, not only a network problem. Inputs and outputs that must ride through a processor takeover need S2: one network card with two connections, one to each processor. Ordinary S1 devices, the ones with a single connection, can be “switched,” which means they move to the new processor. They do notice. There is no R1 on an R system. R1 would be two network cards on two networks. A failed network card, or a dead section of network, still takes that device down.

The R pair is the right economic answer when the feared event is “the processor dies” or “one PROFINET cable gets cut,” and the devices you already standardized support S2. It is the wrong answer when the spec says the remote rack must survive a failed network card.

S7-1500H, the high-availability family

H processors (1517H, and 1518HF when fail-safe and high availability are the same processor) stay in step over dedicated fiber and synchronization modules. Fail-safe means the controller is also certified to stop the machine safely. The PROFINET network is no longer doing two jobs. From firmware V3.0, H also supports R1: the remote device has two network cards, each with its own connection, typically on two networks. R1 is what lets a network card or an entire section of network fail while the device stays in the process. An H pair no longer has to live only inside one MRP ring. A line, or two separated networks, is in the current manual. That flexibility is also how people draw a layout the H pair cannot keep in step. Read the allowed layouts before you draw two rings and four switches.

S7-400H is still running in plants. It is something you migrate away from, not the system to specify on a new machine in 2026, unless you are extending a qualified 400H island and the spare strategy is already funded.

Cost shape: an R pair is two R processors plus a careful MRP ring and S2 devices. An H pair is two H processors, sync modules, fiber, and — if you bought H in order to use it — R1 network cards and a second network. The jump from R to H is not a 10% option. It is a second product tier, and the input/output parts list often moves more money than the processors. Engineering cost tracks that device list: every drive, valve island, and remote rack has to be marked S1, switched S1, S2, or R1. Discovering at the factory test that the main drive is S1-only is how H projects slip. A factory test is the checkout before the machine ships.

B&R: two ordinary X20 controllers, a separate link, POWERLINK underneath

B&R does not sell a separate high-availability controller the way Siemens sells its H family. You use two identical ordinary X20 controllers and set them up as a pair in Automation Studio, B&R’s programming software. One is running. One is the standby. A redundancy link module keeps the picture of the inputs and outputs, and which controller is in charge, in step. B&R’s own description of the switch is on the order of two task cycles — milliseconds when the cycle is short, and only as good as that cycle if you slowed the task down to fit the program. That is a vendor claim. Measure it with the ACOPOS drives and the operator screen attached, not with an empty project. ACOPOS is B&R’s servo-drive family.

The machine network is POWERLINK, and B&R splits backup cabling into two ideas people mix together:

• A ring. One cable break. The device that manages the network keeps the remaining devices. This is the everyday machine feature.
• Two cables. Two physical lines, each device on both, so the paths can leave the cabinet in different trays. This is the process-plant layout. It combines cleanly with the controller pair. It also costs a second run of cable.

Limits that do not fit on the brochure:

• The controller’s built-in POWERLINK port is not automatically the port you use for the backup network. For a redundant X20 pair on POWERLINK, plan on an interface module such as the X20IF2181-2 rather than assuming the built-in jack is allowed. Confirm against the current redundancy manual for the exact controller.
• Redundant supply modules protect the X2X backplane, the power shared inside the rack. They do not, by themselves, give every sensor and valve its own backup supply.
• A third controller on the same network is just another smart device on that network. It is not a third member of the pair. Controller backup here is a pair.
• Missing features show up in Automation Studio, not at the kickoff meeting. The safety-controller tool and some motion layouts have historically been restricted on the redundant pair. Check the current restriction list before you sell “the same program, but with a backup.”

Cost shape: you are doubling an ordinary X20 controller and adding link modules and, usually, POWERLINK interface modules. You are not buying a low-volume specialty “redundancy controller.” That is B&R’s actual economic argument, and it holds when the machine was going to be X20 anyway. It does not hold if you add a pair to a machine whose single point of failure is one ACOPOS drive or one unique valve. For a wider B&R versus Beckhoff choice, see B&R vs Beckhoff. Beckhoff’s everyday backup is an EtherCAT cable ring. That survives a broken cable. It is not the same product as a B&R hot-standby pair of controllers.

CODESYS: a paid add-on, and it is not every controller with the logo

CODESYS Redundancy runs the same IEC 61131-3 application on two controllers. IEC 61131-3 is the common set of programming languages for machine controllers. The first to boot is active, or it runs alone until the partner appears. The passive partner watches and stays in step. If the active side goes quiet, the passive side takes the fieldbus, the network to the drives and remote inputs. A function call can force a switch. The startup copy of the program and the memory you registered for backup are part of what stays in step.

The store datasheet calls this an add-on for a soft PLC — control software running on a computer — and says it is not for embedded devices, the small controllers with the software built into the box. That sentence is about the add-on, not about the brand on the front of the controller. A WAGO PFC, an Eaton XV, or an ifm controller can open a CODESYS project and still not contain the redundancy add-on. The vendor has to ship it in that software, sell the license, and name the two catalog numbers that are a legal pair. Two lookalike controllers are not a pair until the current release notes say they are.

The limits travel with the add-on, whether the box is an industrial PC or a WAGO PFC:

• Exactly one task is kept in step. A task is one repeating slice of the program. Other tasks may run on both controllers. They are not the backed-up state. A machine whose motion, recipes, and alarms live in three repeating tasks does not become redundant by buying the license.
• The link is ordinary TCP/UDP, and it has to be quiet. CODESYS expects a dedicated path whose delay stays inside a known bound. The timeout has to be longer than the wobble in the task plus the wobble in the communication. Set it too tight and both sides decide the other is dead, drop to running alone, and fight over the fieldbus. That split, both sides thinking they are in charge, is a failure this product adds. A single controller does not have it.
• The networks CODESYS supports for this are EtherCAT, CANopen, PROFINET, and Modbus TCP. The active controller owns the network. The passive one is not a second master quietly holding the same outputs. Memory pointers stay on the controller that created them. “Map onto whatever is already there,” and writable network variables, are a known way to build a pair that looks in step and is not.
• EtherCAT cable redundancy is a different feature. A second port that closes a ring survives a cable fault. It does not survive a dead controller.

WAGO is two products, not one checkbox

WAGO is the branded controller people mean when they say “CODESYS PLC.” It has two backup paths, and they are not interchangeable.

• CODESYS Redundancy on the WAGO CODESYS software. WAGO’s 750-8xxx firmware notes add it as a licensed feature (licenses 2759-249/210-1000 or 2759-249/211-1000). The published 2025 setup is two second-generation PFC200s (750-8212). The add-on keeps the program scan in step. The inputs and outputs that must survive sit on a Modbus/TCP coupler, a remote network block both controllers can reach, not on the slices plugged into either controller. WAGO has also pointed the same license question at the Touch Panel 600 and the Edge Controller. Confirm the item number for the exact processor, including a PFC300, against the firmware note for that hardware. Do not turn one PFC200 example into “all WAGO controllers.”
• Application-based controller redundancy is the older e!COCKPIT library (2759-245/211-1000). Two PFC200 masters, Smart Couplers, a dual network or a ring, written for ship-alarm and similar systems with one point of failure. That is a WAGO framework. It is not CODESYS Redundancy, and the license number is not the same. Do not draw both on one architecture slide.

What dies with the controller is the 750/753 rack clipped to that head. The partner does not inherit those modules. Remote inputs and outputs on a coupler both heads can reach are the path that fails over. The same WAGO firmware notes also say the CODESYS PROFINET controller is not an MRP cable ring, is not a daisy chain, and should stay small. It is not Siemens S2 or R1 just because the programming tool looks familiar.

Other CODESYS badges get the same test. Eaton, ifm, a panel PC, or a machine builder’s private software is in this category only when that vendor’s release note names the redundancy add-on, the two legal catalog numbers, and which inputs and outputs are remote. Schneider’s M580 Hot Standby is not this product, even where a smaller Schneider controller is built on CODESYS.

Cost shape: two matching controllers (two PFCs, two panels, or two industrial PCs), two redundancy licenses, and usually a coupler rack that is not sitting on either processor. The license is still the small line. The second controller and the remote inputs are the bill. You do not get a fiber sync module or a second network card in the box. This is a fair design when those exact controllers are already the standard and the inputs that matter can move to a coupler. It is a weak design when the spec says “equivalent to S7-1500H” and means R1 inputs — two network cards on two networks — a qualified sync fiber, and a spare strategy the plant already knows.

The rest of the short list

The same layered question applies to the other names that show up in a US bid.

• Schneider Modicon M580 Hot Standby is a real pair, with a sync link and backup Ethernet remote inputs and outputs (the CRA and CRP modules). HSBY is Schneider’s name for that hot standby. Treat it like ControlLogix or the S7-1500H: ask which remote drops are actually in the hot-standby layout and which are ordinary drops that will bump when the controller switches.
• Mitsubishi sells redundant process processors in the iQ-R family, and older Q-series redundant pairs are still running in plants. A standard iQ-R machine processor is not that product just because it sits in a similar rack.
• Omron has a two-processor history on older CJ hardware and a strong cable-ring practice on NJ and NX. A ring is not a pair of controllers kept in step. Ask for the manual section that describes how the program state moves to the partner, not the section that describes a cable healing itself.
• Beckhoff TwinCAT should be specified first as EtherCAT cable redundancy, plus a sensible battery backup and a spare copy of the industrial-PC hard-drive image. TwinCAT is the software that turns that PC into the controller. If someone is promising a hot-standby controller pair, make them show the supported setup and the switchover test. Do not infer it from the fact that EtherCAT can close a ring.

Cost: what actually moves the number

Ignore any slide that says “a backup is 10% more.” That sentence is true for a ring of cable. It is false for a controller pair, and it is wildly false for backup inputs and outputs. These are planning ratios from project work, not distributor quotes. Get the quote. Use the ratios to see whether the request even matches the failure.

Put the downtime number next to that table before you argue about brands. If one unplanned hour of the machine is worth more than the controller pair, the hardware argument is already over, provided the processor is a believable cause of that hour. If the last five outages were a photoeye, a variable-frequency drive, and a network switch on one flat network with no separation, a second processor is an expensive way to leave the outage rate alone. A variable-frequency drive is the box that controls a motor’s speed.

Hidden costs that never land on the processor line:

• Matched spares. Two different firmware versions is how a pair refuses to stay in step on a Saturday.
• The test. A backup project without a written switchover procedure — pull the primary power, pull one fiber, pull one network, force a switch during a running cycle — was not commissioned.
• Limits that force a redesign. Motion not supported, only one CODESYS task kept in step, drives that are S1 only, a B&R feature that will not load on the redundant controller. This is discovered in engineering, and it is billed there.
• The operator screen, the historian, and the alarm server that point at one network address and do not follow whichever controller is primary. A historian is the database that stores machine readings over time. Rockwell and B&R both address this in the product. A homemade pair often does not.
• Security scope. Two controllers, a sync link, and a ring are more places to attack, not fewer. The sync path does not belong on the office network. A CODESYS backup link running across one flat plant network, with no separation from everything else, is a design error.

Questions to answer before implementation

If these are not answered in writing, the parts list is a guess. They are in the order that changes the purchase, not the order that makes a workshop feel thorough.

The failure

1. Which single failures must the machine ride through with no operator action: CPU, 24 V supply, one network cable, one switch, one remote interface module, one drive, one panel, loss of the whole cabinet?
2. Which of those happened in the last three years, and which are on the spec because a standard template said “redundant”?
3. Is a planned 15-minute CPU swap during a weekly sanitation window acceptable? If yes, a tested spare and a backup image may beat a hot-standby pair.
4. What is an hour of this asset worth, in lost product, scrap, or contractual penalty? Compare that to the layer you are about to buy, not to a generic “downtime is expensive.”

The process during switchover

5. How long may outputs freeze, hold their last state, or drop? Name it in milliseconds or in “one machine cycle,” and make the vendor put their switchover claim next to it.
6. Are motion axes allowed to fault and go back to home, or must they stay locked in the mechanical relationship they had? Backup logic with a drive that has no backup usually faults the axis. Get the drive vendor in the room.
7. What happens to sequences already in progress, running totals, batch steps, and the built-up value inside a control loop? “The program is the same” is a different claim from “the machine’s current state is the same.”
8. Is a bump in the output — a one-scan glitch, one pass of the program — a quality event, a trip, or nothing? Outputs tied to safety need a defined state. Hoping the pair is fast is not a state.

I/O, drives, and networks

9. For every remote rack and drive: is it S1, switched S1, S2, R1, redundant-owner EtherNet/IP, POWERLINK on one ring, or POWERLINK on two cables? Write the list. The list is the design.
10. Can the device be replaced without stopping the other controller? If maintenance cannot swap the failed primary until the next outage, you bought availability on paper.
11. Where do the two network paths physically run? Same tray and same connector panel is one failure with extra cable.
12. Who is the ring manager, and what happens when that device is the one that fails?

The application and the people

13. Which instructions, motion axes, and safety tasks are unsupported on the redundant CPU you selected? This is a manual question, not a salesperson question.
14. On CODESYS, including WAGO: does this exact catalog number’s current firmware include the redundancy component, which single task holds the state, and is the I/O that must survive on a coupler both heads can reach rather than on the slices clipped to one PFC?
15. Who can force a switchover at 2 a.m., and is that procedure in the HMI or in a PDF nobody opens?
16. Do you have two matched spares, a firmware policy, and a rule that the pair is updated as a pair?
17. Does the integrator’s team have a commissioned redundant system on this platform, or is this the first one? Price the first one as a first one.

Safety, security, and the contract

18. Is the requirement staying online, stopping safely, or both? A redundant ordinary controller is not a safety controller. GuardLogix, S7-1500F, B&R Safety, and CODESYS Safety are the safety products. The 1518HF exists because Siemens’s answer to “both” is a specific processor, not a checkbox on a standard 1517.
19. What is the safe state if the pair loses sync and both sides start running alone? If you cannot describe it, do not ship it.
20. Is the sync link written down in the network zones, the separated areas of the network, or did it end up on the same switch as the cameras?
21. What will the factory test and the site test actually pull: primary power, one fiber, one piece of the ring, one network card, a forced role switch during a running cycle? The site test is the checkout after the machine is installed. If it is not in the procedure, it will not be tested.
22. Who owns the system after year two — plant technicians, the OEM, or a contractor who has never seen the redundancy manual?

What not to do

• Do not write “redundant PLC” on the piping and instrument diagram and leave unnamed which backup you mean: cable, power, processor, or inputs.
• Do not put two CompactLogix controllers on a cable ring and call it ControlLogix redundancy.
• Do not buy an S7-1500H and then fill the racks with S1 devices, one connection each, to save the network cards. You paid for a failure the devices cannot ride through.
• Do not run a CODESYS backup link across a crowded plant network, do not keep “whichever task is convenient” in step, and do not assume the 750 slices clipped to a WAGO controller fail over with the program.
• Do not skip the switchover test because the download worked.
• Do not treat a backup controller as a substitute for a safety function, a spare drive, or a network that is already one flat switch.

A practical order of operations

On most discrete and hybrid machines the honest sequence is:

1. Fix power (second supply, redundancy module) and the network ring. These pay for themselves on nuisance trips.
2. List the devices that are allowed to stop the asset. Make the drives and the one-of-a-kind instruments visible.
3. Only then decide whether the processor itself is on that list. If it is, pick the pair your maintenance team can actually support. ControlLogix if the plant is already Logix and the manual’s supported list covers the inputs. S7-1500R if a PROFINET ring and S2 devices, one card with two connections, are enough. S7-1500H if a network card or a whole section of network must be allowed to fail. B&R if the machine is already X20 and POWERLINK: two ordinary controllers, not a separate high-availability family. CODESYS or a WAGO PFC pair only when that exact software includes the redundancy add-on, the inputs that must survive are remote, and you can live with one task kept in step.
4. Write the switchover test into the factory test before the purchase order, not after the dispute.

Orgenis can turn a “make it redundant” request into that device list and a platform recommendation — including the recommendation to stop at a ring and a spare CPU when that is the truthful design. If the platform decision is still open, start with the machine-control comparison in B&R vs Beckhoff and the IPC context in why PC-based control keeps showing up. Redundancy does not repair a bad platform choice. It doubles it.