A process engineer is specifying the control system for a continuous chemical reactor. The reactor cannot be shut down without losing an entire batch of product, and a batch is worth more than the entire PLC system. The engineer specifies an ABB PLC with CPU redundancy. But when the purchase order is reviewed, a question arises: what does redundancy actually mean in practice? Does the secondary CPU sit idle until the primary fails? How quickly does the switchover happen? And what happens to the outputs during the transition? These are not academic questions. The answers determine whether the redundancy is real or merely a marketing term. In an ABB PLC system, CPU redundancy is a specific technical architecture with defined synchronization mechanisms, switchover times, and failure modes. Understanding this architecture is essential for buyers who are paying a premium for availability.
This guide is written for procurement engineers and system integrators who need to evaluate ABB PLC redundancy for critical applications. We will explain the primary/secondary architecture, the synchronization process, the switchover mechanism, and the I/O handling during a switchover. We will also cover the criteria for evaluating a supplier and the product parameters from our factory at Yueyang Tongtu E-commerce Co., Ltd. Whether you are specifying a new system or upgrading an existing one, this guide will help you understand what CPU redundancy actually delivers in an ABB PLC system.
CPU redundancy in an ABB PLC system means that two CPU modules are configured to operate in parallel, with one designated as the primary and the other as the secondary. The primary CPU is the active controller. It executes the application program, writes data to the I/O modules, and communicates with the supervisory system. The secondary CPU is not idle. It also executes the application program and reads the I/O, but it does not write to the outputs. It receives synchronization data from the primary so that its internal state matches the primary's state. If the primary CPU fails, the secondary CPU takes over as primary and begins writing to the I/O. This architecture is known as hot standby. Both CPUs are running; the secondary is ready to take over at any moment[citation:1][citation:3].
The key distinction between redundancy and simple backup is that the secondary CPU is continuously synchronized. It is not a cold spare that must be powered up and loaded with the program when a failure occurs. It is a running system that already knows the current state of the process. This means that the switchover can happen without a full restart, and the process can continue with minimal interruption. The table below summarizes the key characteristics of ABB CPU redundancy.
| Characteristic | ABB CPU Redundancy |
| Architecture | Hot standby (both CPUs running) |
| Primary CPU Role | Executes program, reads I/O, writes outputs |
| Secondary CPU Role | Executes program, reads I/O, receives sync data |
| Synchronization | Continuous transfer of critical data from primary to secondary |
| Switchover Trigger | Primary CPU failure, power loss, or communication fault |
| Switchover Time | Typically in the millisecond range (application dependent) |
| I/O Handling During Switchover | Outputs hold last state; inputs continue to be read |
At Yueyang Tongtu E-commerce Co., Ltd., our factory supplies ABB PLC systems configured for redundancy. We work with our customers to specify the right level of redundancy for their application, from simple CPU redundancy to fully redundant systems with redundant I/O and communication networks. Our technical team can assist with the selection process and provide detailed system architecture diagrams.
The synchronization between the primary and secondary CPUs is the mechanism that makes redundancy work. Without synchronization, the secondary CPU would be out of date when it takes over, and the process would experience a discontinuity. ABB PLC systems use a dedicated synchronization connection between the two CPUs. This connection is separate from the control network and the I/O network, ensuring that synchronization continues even if there is a network fault. The synchronization data includes the critical internal variables of the application: the state of timers and counters, the values of setpoints and control variables, and the historical data needed for bumpless transfer. The secondary CPU receives this data continuously, so its state matches the primary's state within one scan cycle[citation:3].
The synchronization connection also carries a heartbeat signal. Both CPUs monitor this signal to confirm that the other CPU is alive. If the secondary CPU stops receiving the heartbeat from the primary, it interprets this as a primary failure and initiates a switchover. In some ABB systems, a second independent connection is used to distinguish between a synchronization link failure and a CPU failure. This prevents a situation where a broken sync cable causes both CPUs to attempt to become primary simultaneously. The table below summarizes the synchronization architecture.
| Element | Function | Importance |
| Synchronization Link | Transfers critical application data from primary to secondary | Ensures secondary is ready to take over without data loss |
| Heartbeat Signal | Confirms that the other CPU is alive and operating | Enables rapid detection of primary failure |
| Independent Sync Path | Separate physical connection for sync data | Prevents network faults from disrupting synchronization |
| Link Monitoring | Detects sync link failure vs. CPU failure | Prevents dual-primary conflict |
At our factory, we supply ABB PLC systems with the correct synchronization hardware and configuration for each application. We can provide the sync cables, communication modules, and configuration guidance needed to establish reliable redundancy. Our goal is to ensure that the secondary CPU is always ready to assume control.
The behavior of the I/O during a switchover is a critical factor in determining whether the redundancy is truly bumpless. When the primary CPU fails and the secondary takes over, there is a brief period during which neither CPU is actively writing to the outputs. The behavior of the outputs during this period depends on the I/O system and the configuration. In ABB AC 800M systems with redundant I/O, the output modules in a redundant pair are both active and both receive the same values from the controller. This means that if one module or one CPU fails, the other module continues to drive the outputs without interruption[citation:2][citation:9]. For non-redundant I/O, the outputs typically hold their last state during the switchover. The switchover time is short enough that most processes do not notice the interruption. The table below summarizes I/O behavior during switchover.
| I/O Configuration | Behavior During Switchover | Process Impact |
| Redundant I/O (both modules active) | Uninterrupted control; no output freeze | None (true bumpless transfer) |
| Non-redundant I/O | Outputs hold last state | Brief freeze (milliseconds) |
| Redundant communication network | Traffic switches to secondary network | Minimal (network switchover) |
At Yueyang Tongtu E-commerce Co., Ltd., we help our customers specify the right I/O configuration for their redundancy requirements. For applications that cannot tolerate any output interruption, we recommend redundant I/O modules in addition to redundant CPUs. For applications that can tolerate a brief freeze, non-redundant I/O with redundant CPUs may be sufficient. Our technical team can advise on the optimal configuration for your process.
The switchover time in an ABB PLC system is the time between the detection of a primary CPU failure and the secondary CPU taking over as primary. This time is critical for applications that cannot tolerate a prolonged interruption. In ABB AC 800M systems, the switchover time is typically in the millisecond range, though the exact value depends on the system configuration and the application. The switchover is triggered by several conditions: a hardware fault in the primary CPU, a power loss, a watchdog timeout, or a communication fault that prevents the primary from communicating with the I/O. When one of these conditions is detected, the secondary CPU immediately assumes the primary role and begins writing to the outputs[citation:1][citation:5].
The speed of the switchover is determined by the failure detection mechanism and the synchronization state. If the secondary CPU is fully synchronized, the takeover can happen within a few milliseconds. If the synchronization is not current, the secondary may need to perform additional steps before it can safely take over. This is why continuous synchronization is essential for fast switchover. The table below summarizes the switchover triggers and typical times.
| Trigger | Detection Method | Typical Switchover Time |
| Primary CPU hardware fault | Watchdog, self-diagnostics | Milliseconds |
| Primary CPU power loss | Heartbeat loss | Milliseconds |
| Communication fault | Network monitoring | Milliseconds to seconds (depending on fault) |
| Manual switchover | Operator command | Milliseconds |
At our factory, we supply ABB PLC systems with tested and validated redundancy configurations. We can provide documentation on the switchover performance for the specific system you are considering. Our engineering team can assist with the configuration of the switchover triggers and the testing of the system to verify that it meets your availability requirements.
Evaluating a supplier of ABB PLC systems for redundancy applications requires more than checking that they stock the hardware. The supplier must have expertise in redundancy architecture, configuration, and testing. The key criteria are application engineering capability, configuration expertise, testing and validation support, and after-sales service. Application engineering capability means the supplier can analyze your process and recommend the right level of redundancy. Configuration expertise means they can correctly configure the primary/secondary relationship, the synchronization, and the I/O handling. Testing and validation support means they can demonstrate that the redundancy works as specified. After-sales service means they can support the system over its lifecycle, including spare parts and troubleshooting. The table below summarizes these criteria.
| Evaluation Criterion | What to Look For | Why It Matters |
| Application Engineering | Experience with redundant systems in similar processes | Ensures the right redundancy level for the application |
| Configuration Expertise | Certified ABB engineers, documented configurations | Ensures the redundancy works as designed |
| Testing and Validation | Factory acceptance testing, switchover testing | Verifies performance before shipment |
| After-Sales Service | Spare parts, technical support, training | Ensures long-term reliability |
| Track Record | References from similar redundancy projects | Demonstrates capability and reliability |
At Yueyang Tongtu, our factory has extensive experience in ABB PLC systems for critical applications. We have a team of certified engineers who specialize in redundancy configuration and testing. We provide factory acceptance testing that includes simulated primary failures to verify the switchover. And we offer after-sales support, including spare parts and technical assistance. We invite you to evaluate us against these criteria and to consider us as your partner for ABB PLC redundancy applications.
The following table provides the key product parameters for ABB PLC systems configured for CPU redundancy. These systems are based on the AC 800M controller family, which supports full CPU redundancy with hot standby operation. Our factory can supply complete systems or individual components to meet your specific requirements.
| Parameter | Specification | Notes |
| Controller Family | ABB AC 800M | Supports CPU redundancy |
| Redundancy Type | Hot standby (primary/secondary) | Both CPUs running in parallel |
| CPU Modules | PM86x series (redundancy-capable) | Selected based on processing requirements |
| Synchronization | Dedicated sync link | Separate from control network |
| Switchover Time | Milliseconds (application dependent) | Tested and documented |
| I/O Redundancy | Optional (S800 I/O redundant pairs) | For bumpless transfer |
| Network Redundancy | RNRP (Redundant Network Routing Protocol) | For communication availability |
| Power Supply Redundancy | Optional (redundant power supplies) | For complete system availability |
| Engineering Software | ABB Control Builder / 800xA | For configuration and programming |
| Certifications | CE, UL, SIL (depending on model) | Selected for application requirements |
At our factory, we supply ABB PLC systems with the configuration and components needed for reliable CPU redundancy. We can provide the CPU modules, synchronization hardware, I/O modules, and network equipment as a complete system or as individual components. Our engineering team can assist with the system design and provide the documentation needed for validation and maintenance.
Question 1: Does the secondary CPU run the same program as the primary CPU?
Answer: Yes. In an ABB PLC hot standby redundancy system, both CPUs run the same application program. The primary CPU writes to the outputs, while the secondary CPU executes the program but only reads the inputs. The secondary receives synchronization data from the primary so that its internal state matches the primary's state. This ensures that the secondary can take over immediately if the primary fails.
Question 2: What happens if the synchronization link fails?
Answer: If the synchronization link fails, the secondary CPU loses its synchronization data. In some ABB systems, a separate monitoring connection is used to distinguish a sync link failure from a CPU failure. If the sync link fails but both CPUs are healthy, the system may continue with the primary CPU operating alone, and an alarm is generated. The secondary CPU may need to be resynchronized before it can serve as a backup again.
Question 3: Can I add CPU redundancy to an existing ABB PLC system?
Answer: It depends on the existing system. Some ABB PLC models, such as the AC 800M, support adding a redundant CPU module if the original CPU is redundancy-capable and the rack has space for the second module. Other models may not support field upgrades. You should consult with an ABB system integrator to determine whether your existing system can be upgraded to redundancy.
Question 4: How do I test that the redundancy actually works?
Answer: The standard method is to perform a factory acceptance test that simulates a primary CPU failure. This can be done by removing power from the primary CPU, stopping it, or disconnecting its communication link. The test verifies that the secondary CPU takes over within the specified time and that the outputs behave as expected. At Yueyang Tongtu E-commerce Co., Ltd., we include switchover testing as part of our factory acceptance testing for redundant systems.
Question 5: What is the difference between CPU redundancy and I/O redundancy?
Answer: CPU redundancy protects against a failure of the controller. I/O redundancy protects against a failure of the input or output modules. A system can have CPU redundancy without I/O redundancy. In that case, if an I/O module fails, the process may still be affected even though the CPU is healthy. For true bumpless redundancy, both CPU and I/O redundancy may be required. The choice depends on the criticality of the process and the acceptable level of interruption.
CPU redundancy in an ABB PLC system is a specific technical architecture that provides high availability through hot standby operation. The primary and secondary CPUs run in parallel, with continuous synchronization of critical data. If the primary fails, the secondary takes over within milliseconds, and the process continues with minimal interruption. The level of bumplessness depends on the I/O configuration: redundant I/O provides uninterrupted control, while non-redundant I/O holds the last state during the switchover. For buyers, understanding this architecture is essential for specifying the right level of redundancy for their application. At Yueyang Tongtu E-commerce Co., Ltd., our factory has the expertise and the experience to supply ABB PLC systems configured for reliable redundancy. We provide application engineering, configuration, testing, and after-sales support to ensure that your system meets your availability requirements.
Whether you are specifying a new control system for a critical process or upgrading an existing system, we invite you to contact us to discuss your requirements. We can provide system architecture recommendations, product specifications, and testing documentation. Our commitment to quality and customer satisfaction has made us a trusted partner for industrial automation around the world.
Contact Yueyang Tongtu E-commerce Co., Ltd. today to discuss your ABB PLC redundancy requirements and discover how our systems can provide the availability your process demands.
-
