Water plants, power grids, refineries — some processes simply must not stop. Hot Standby runs two identical M580 CPUs: a primary in control and a standby shadowing it, their memory synced every scan over a dedicated link. Kill the primary and the standby takes over bumplessly — the process never notices. Try to break it.
CPU A is primary, controlling a tank-level process; CPU B is standby, receiving A's full memory image every scan over the sync link. The tank fills and the active CPU holds the level. Press 💥 Fail the primary — watch B promote itself to primary within a scan, the level control continue without a blip, and the switchover get logged.
The magic is the synced memory: because the standby already holds the primary's exact state — every timer, counter and step — it resumes mid-process, not from a cold start. Repair the failed CPU and it rejoins as the new standby, ready for next time.
🔄 State sync every scan. The primary copies its full data image to the standby over a dedicated fibre link at the end of each scan — so the standby is at most one scan behind.
👑 One commander at a time. Only the primary drives the outputs. The standby watches silently; promotion is instant and exclusive, so the field never sees two masters.
🔌 Shared RIO. Both CPUs see the same Remote I/O ring (Track 07), so whichever is primary already owns the live I/O — no rewiring on switchover.
🪪 Identical apps. Both run the same logic; you download once and HSBY keeps them matched. A logic mismatch blocks the pair from going redundant.
When the primary fails, the standby resumes the process mid-stride — timers and counters intact — instead of restarting from zero. What makes that possible?