How Do You Design A Redundant Industrial Ethernet Network?

Industrial Ethernet networks must be resilient in order to withstand disturbances, faults and failures that can lead to unplanned downtime. 

It’s hard enough at the best of times to keep a network resilient and continuously available. When you’re operating in industrial situations, you’ll likely be facing additional challenges such as harsh environmental conditions, electrical interference, extreme temperatures and unforeseen network outages.

What Is Network Redundancy?

People often treat network resilience and network redundancy as the same thing, but redundancy is actually a subset of network resiliency. There are four of these subsets, sometimes called the “four Rs”: 

•  Redundancy

•  Rapidity

•  Resourcefulness

•  Robustness

Network redundancy operates on the same principle as backing up your files or your PLC: you set up a duplicate network, either physical or virtual, of your system hardware and connections. If you suffer an unexpected failure of a device or connection, you have a spare to take over its task and resume normal network operation. If you don’t have an effective redundancy backup or disaster recovery plan, you’ll suffer far more trouble getting your systems up and running again.

Redundant firewalls represent a common example of redundancy. These operate in both active and standby modes at the same time, by way of a primary firewall and a secondary backup unit. This backup unit remains in standby mode while at the same time monitoring the active primary firewall’s functional health. If it detects a failure in the active unit, the backup unit takes over, changing its status from standby to active.

Alternatively, you can set both units to operate actively, sharing equal responsibility for routing and enforcing firewall security rules. If one unit goes down, the other unit continues to perform both its own tasks and those of the failed unit. 

Ethernet Switching Redundancy Protocols

Another example of network redundancy is found in industrial Ethernet switching. In this scenario, any failure in the switching between links is covered by an alternative data path available in the redundant network. 

For example, in a star topology, you have a single switch or hub forming the centre node of the star. This operates as a server to which every connected device or client node is linked. Any device in the network wanting to connect to another must first send its data to the star’s central node, the network switch, which sends the data on to whatever device is designated to receive it. 

This means providing multiple paths from the central server node or network switch to the client nodes. But this has the obvious disadvantage of simultaneous failure of all connected nodes if the network switch fails, disabling network communication between multiple data centres. All single-path network designs are subject to this major drawback: failure of any aspect disrupts every type of network communication, whether it’s a disconnected cable, a power outage, or hardware failure.

To improve network redundancy, you can either add extra industrial switches or segments, or just use an altogether different topology, such as redundant rings, link aggregation or mesh. However, any computers that are exchanging data over a LAN that has redundant pathways may be subject to looping issues. This could eventually lead to a broadcast storm.

Broadcast Storm

Broadcast storms don’t happen so much these days, since the evolution of better quality and more robust Ethernet devices. They occur when a legitimate network is flooded with bogus frames, which disrupt the traffic of important frames to and from the network. This is often (but not always) caused by Ethernet device failure, improper network configuration, or malicious denial-of-service cyberattacks. 

The problem is called a broadcast, because bogus frames go out to everyone, via a switch giving access to all ports. This is more avoidable now because switches are designed with broadcast storm protection. This recognises and suppresses suspiciously large transmissions of broadcast frames, preventing the bogus frames from spreading through the network. The switch protection resets once the threat has subsided so that normal traffic may resume. Most modern switches have this feature as a default setting, although there are some rare applications where broadcast traffic is expected, and you have to turn the protection off to permit it.

Spanning Tree Protocols

Network administrators have been figuring out for a long time how to avoid broadcast storms and break looping cycles. One of the most popular ways of doing this is the layer two Spanning Tree Protocol (STP). This protocol blocks all the ports on a redundant network to prevent the occurrence of network loops. In such a network, it’s still possible for a single device to receive data when a port is blocked, but it can’t transmit that data to any other devices connected to the network. Any links not on the spanning tree are disabled, so that any two network nodes have only a single primary path of communication and one active channel between them. STP can circumvent network failures by rerouting data around the failed node so that connected devices can continue to communicate. 

Why Design A Redundant Ethernet Network?

In our interconnected modern world, an industrial outage can have catastrophic effects, causing serious losses in production and profitability. According to recent research, manufacturers in the UK and Europe are estimated to lose at least £80 billion this year in unplanned downtime. While some of this is due to problems like equipment failure or supply chain delay, some 31% of manufacturers suffered a financial impact in 2024 from cyberattacks and other issues affecting OT/IT systems. 

Resilient industrial networks can help prevent this costly downtime by restoring interrupted network functions: designing a redundant industrial network forms an important part of this resiliency. The goal of resilient network infrastructures is to achieve the “five nines” of network availability. This stands for a 99.999% goal of uninterrupted operation, equating in manufacturing terms to about six minutes of annual network downtime. Although this seems like an impossible target, designing a redundant industrial Ethernet network is a critical contributing factor.