Safety

System redundancy

ActivePublished: 24 October 2026Updated: 24 October 2026Published

Key innovation

Deliberate duplication of critical components and functions so that the failure of any single element does not bring down the whole system — the foundation of fault tolerance and high availability.

How it works

The system is provisioned with more resources than the minimum needed to operate. A monitoring mechanism (health-check, watchdog, diagnostics) detects a component's failure, after which a failover to the spare element occurs — immediate with hot standby, delayed with warm/cold standby. In voting architectures (TMR/NMR) multiple modules process the same input in parallel, and a voter compares the results and forwards the value indicated by the majority, masking a single module's error with no interruption. In active-active mode the load is spread across many nodes and, when one fails, the others absorb its traffic. Critical to effectiveness is ensuring independence of the redundant elements (separate power, cabling, locations and, for software redundancy, different implementations) so that one cause cannot damage all copies at once.

Problem solved

A single point of failure means that damage to one element halts the entire system. Redundancy removes this problem by ensuring continuity of operation and safety despite the failure of individual components — in systems where downtime or failure carries a high cost or threatens life.

Components

Redundant (spare) elementDuplicated resource that takes over the function after the primary element fails

A physical or logical resource (power supply, disk, processor, node, service instance) added beyond the minimum required for the system to operate.

Official

Fault detection and monitoringDetects malfunction and triggers switchover to the spare element

Health-checks, watchdogs and diagnostics that detect failure — a necessary condition for effective redundancy; an undetected spare failure stays a latent fault.

Voter mechanismSelects the correct result by majority vote in TMR/NMR architectures

A unit comparing the outputs of several parallel modules and forwarding the majority value, masking a single module's error.

Official

FailoverTransfers load or role from the failed element to the spare

Switchover logic — immediate (hot standby), delayed (warm/cold standby) or continuous load sharing (active-active).

Official

Implementation

Implementation pitfalls

Common-cause failureCritical

Identical redundant elements can fail simultaneously from the same cause (the same design/software bug, shared power, a defective hardware batch), negating the benefit of redundancy.

Fix:Diversity: different implementations (N-version), different vendors, separate power and locations.

Single point of failure in the voter/failover mechanismHigh

The voter or failover switch itself can become a single point of failure that defeats the whole redundancy scheme.

Fix:Redundancy of the voting/switching mechanism itself and self-checking circuits.

Latent fault in the spare elementHigh

An inactive spare (cold/warm standby) may be damaged unnoticed and fail only when it is finally needed.

Fix:Regular tests and health-checks of spare elements plus periodic diagnostics.

Split-brain and false failovers in active-activeMedium

In distributed systems a loss of connectivity can cause split-brain, where two nodes both consider themselves active and corrupt data consistency.

Fix:Quorum mechanisms and fencing (STONITH).

Cost and complexityMedium

Full redundancy (2N) doubles hardware, power and maintenance cost and increases operational complexity.

Fix:Match the redundancy degree to the function's criticality (e.g. N+1 instead of 2N where sufficient).

Evolution

Original paper · 1956 · Automata Studies, Annals of Mathematics Studies 34, Princeton University Press · John von Neumann

Probabilistic Logics and the Synthesis of Reliable Organisms from Unreliable Components

John von Neumann

1956

Formalisation of redundancy via majority voting

Inflection point

John von Neumann formalises building reliable systems from unreliable components (multiplexing / majority voting) — the theoretical basis of TMR and NMR.

1976

Commercial fault-tolerant systems (Tandem NonStop)

Inflection point

Hardware redundancy with failover reaches commercial continuous-availability systems, popularising high availability in transaction processing.

2015

Redundant fail-operational architectures in autonomous vehicles

Autonomous driving forces duplication of steering, braking, power and compute paths so the system stays operational despite a single failure.

Fail-operational (concept)

Hyperparameters (configurable axes)

Redundancy degree (N+1, N+x, 2N, 2N+1)Critical

How many spare resources are provided beyond the minimum N. N+1 is one spare; 2N is full duplication of independent paths.

Standby mode (hot / warm / cold)High

Readiness state of the spare, determining switchover time and the cost of maintaining the spare.

Load configuration (active-active / active-passive)High

Whether spare nodes serve traffic continuously (active-active) or take over only after failover (active-passive).

Number of voting modules (TMR = 3, NMR)Medium

Number of parallel modules in a voting architecture; TMR uses three, NMR generalises to N modules.

Diversity (independence from common cause)Critical

Degree of differentiation between redundant elements (different designs, vendors, implementations, locations), limiting common-cause failures.

Hardware requirements

Primary

System redundancy is an architectural principle independent of any specific hardware type — applied on any compute platform and infrastructure.

Sources

Redundancy (engineering)

article

Wikipedia

Triple modular redundancy