Redundant radio paths

A second radio path, carrying a copy of every frame, is the only design that can hide a roam or an interference burst completely. It works exactly as well as the two paths fail independently, and no better.

Everything else on this site shortens the gap. This page is about covering it.

A faster roam is still a gap

The strongest objection is that you should fix the roam instead. Faster roaming does shrink the gap, and the ways to shorten or hide it are worth doing first. But a single radio has to leave one access point to join the next, and it cannot hear its own network while it scans. NIST’s deployment guide says plainly that handing off from one access point to another can be too slow, and recommends path redundancy wherever RF conditions can change, which it says describes most industrial environments.

Redundant coverage is not the same thing as a redundant path. A backup access point that a client joins only after the primary fails is failover, and failover has its own gap. One industrial Ethernet design guide warns that association to the backup can take up to 30 seconds, long enough to time out I/O connections¹.

A redundant path is different. Both paths carry traffic all the time, so when one goes quiet, the other is already delivering.

Two radios, two channels, two networks

The design is simple to draw. The vehicle carries two Wi-Fi radios. Each associates with its own access points, on its own channel, on its own network name. The sender transmits every frame on both, and the receiver keeps whichever copy arrives first.

Measured results show what that buys. A research group at Italy’s National Research Council ran the two paths on channels 1 and 11 in an industrial plant with robotic cells and welding guns, for six days per run. On the single channels, the worst-case latency exceeded 2.9 s on one and reached 0.368 s on the other². On the redundant link it never exceeded 62 ms.

A separate group tested a mobile robot crossing a shop floor between two rooms, with one access point in each. The robot’s link to the first access point dropped from about 85 s to 190 s into the run, and traffic kept flowing over the second³. Over the single links, 46.5% and 20.0% of packets took longer than 136 ms; with both paths, 3.9% did.

Both are research testbeds, not products, and neither measured your building. They show the mechanism works when the paths are independent.

PRP is the standard way to do it

The Parallel Redundancy Protocol (PRP) is defined in IEC 62439-3. It attaches devices to two separate networks, with zero recovery time when a network element fails. The mechanism is parallel transmission of duplicated information. Each frame carries a redundancy control trailer so the receiver can match the two copies, keep the first and discard the second.

PRP was written for wired Ethernet, and the wired side is where the work is. The standard describes a doubly attached node (DANP) and a RedBox that moves singly attached devices onto the two LANs. In PRP over Wi-Fi, RedBoxes at each end duplicate and de-duplicate the frames, and each LAN reaches the air through its own access points and its own client radio. At the controller end, that means a controller with two PRP ports or a RedBox in front of it, and two switch paths out to the two sets of access points.

Those two LANs have to stay apart all the way. The same design guide that warns about failover says to connect redundant access points to different switches and use redundant PoE sources. A redundant radio path that lands on one switch shares that switch’s failures.

What breaks independence

Other networks were rarely what tied the two paths together. The researchers traced the residual dependence to the design and configuration of the redundant devices themselves, and to anything else the two paths shared.

One access point serving both paths. With a single dual-band access point carrying both channels, an internal task delayed forwarding on both at once. The redundant link’s 99.99th percentile latency was 20.425 ms with one access point and 5.110 ms with two⁴. The Wi-Fi 7 page explains why multi-link operation ends in one AP MLD; for this purpose, that is one access point.

Both radios scanning or roaming at once. In the testbed, the Linux network service scanned both adapters at the same moment, and one full scan took about 3 s. The researchers’ rule: never scan on both radios together, and finish a reassociation on one radio before starting it on the other. Ask how a vehicle’s client stack decides when each radio roams. If both networks put their cell edges in the same place, both radios reach the same roam decision at the same spot. Offset the cell edges.

Antennas close together on the same band. Two adapters with antennas about 5 cm apart interfered with each other even on channels 1 and 11. In the later study, a radio on channel 165 felt it from almost every other 5 GHz channel tested, and not at all from 2.4 GHz. Put the two radios in different bands, keep the channels far apart, and test with both transmitting.

Shared power, switch, or cabinet. One PoE switch feeding both access points makes one failure take out both paths.

Shared settings. Power-save clients on a network can force multicast to wait for beacons on both channels at the same time. The DTIM cause page covers it.

The same obstruction. If both access points sit on the same pole, a large object that blocks the direct path blocks both. Mount them where steel cannot shadow both at once. The moving metal page covers shadowing.

When those shared causes were removed, the measured results came within 10% of what independent channels predict.

Wi-Fi plus private 5G as the second path

The second path does not have to be Wi-Fi. A private 5G radio is a different band, different infrastructure, and a different set of failure modes, which is what independence asks for. The private 5G page covers its spectrum, its operating model, and its own handover gap.

Keep the roles honest. Wi-Fi still carries the plant floor. A 5G path beside it helps most when its cell edges sit away from your Wi-Fi roam points, and it counts only once its gap is measured the same way you measure Wi-Fi’s.

What the second path costs

Airtime. Plain PRP doubles the traffic over the air for everything it duplicates. Duplicate control traffic only, never video or file transfers. The airtime guide explains why the budget is finite.

Channels. Every vehicle path now needs two clean channels, ideally in two bands, through its whole route.

Configuration and watching. Two networks, two client configurations, two roaming policies, RedBoxes, and twice the wired paths. A redundant system that has quietly lost one path is a single-path system, and nothing on the floor will tell you. IEC 62439-3 includes a network supervision function. Make sure yours alarms on a dead path the day it dies.

What redundancy does not do

It does not make Wi-Fi deterministic. Even after every fix, one run’s redundant worst case was 133.312 ms, because one copy was lost and the other took the longest delay its channel saw in that run. The plant test’s 62 ms redundant worst case is still longer than the 40 ms⁵ a CIP Safety input connection allows at default settings. Redundancy shortens the tail. It does not remove it.

It is not a safety function. CIP Safety and PROFIsafe treat the network as a black channel, as the safety over wireless guide explains, and a second path does not change what happens when both go quiet. PI draws the line clearly. Wireless is permitted as long as sufficient availability, with no nuisance trips, can be guaranteed, and redundancy is a means to keep the automation running through failures, not a safety measure. Availability is what a second path buys.

Measure the redundant link the same way you measure a single one, with the roam gap method, and hold its worst case against the timeout in the Timing Budget.

What to ask a vendor

Which parts the two paths share: access point, switch, power supply, cabinet, antenna mast, controller.
Whether the client can stop both radios from scanning or roaming at the same time, and how.
How far apart the vehicle’s two antennas are, and which bands each radio uses.
Which RedBoxes or doubly attached devices sit at each end, and how a copy that arrives long after its twin is handled.
How a dead path is detected and alarmed.
The measured worst case on the redundant link, with the test conditions.

Two radios that share a switch, a schedule, or a pole are one radio with extra parts. Build two paths that fail apart, then prove it.