N+1 is one of the most useful ideas in reliability engineering, and once you see the pattern you spot it everywhere - in power supplies, cooling units, comms links, and SCADA servers. It answers a practical question: how many units do I need to buy so that any one of them can fail without taking down the job? This guide teaches N+1 from first principles, shows how it applies across a control system, contrasts it with 2N and N+2, and works through a simple sizing example so you can pick the right scheme for the redundancy you are specifying.
N+1 Redundancy in one line: N+1 redundancy means providing one more unit than the number actually required to carry the load. If N units are needed to run the system, N+1 installs one extra spare so that any single unit can fail and the remaining units still meet demand. It is the most cost-efficient way to survive one failure at a time, which is why it is the default redundancy scheme for many infrastructure components.
Start with N, the number of units genuinely needed to carry the full load. If three cooling units are required to remove the heat a room produces, N is three. Now add one more identical unit as a spare, and you have N+1: four units, one of which is surplus at any given moment. The value of that surplus is that any single unit can fail and the remaining three still cover the full load, so the failure is absorbed without loss of service. The one spare does not have to be a dedicated backup sitting idle - in many N+1 designs all units share the load and simply run a little below their limit, so that losing one just raises the others to full duty.
The defining limit of N+1 is that it protects against exactly one failure at a time. Once a unit has failed and the spare is covering for it, the system is temporarily back to having no margin - a second failure before the first is repaired would take it below N and cause an outage. That is an acceptable risk for many systems, because two independent failures in the same short repair window are unlikely. N+1 is therefore a deliberate bet: pay for one extra unit, survive any single failure, and repair quickly enough that a second concurrent failure stays improbable.
The pattern repeats at every tier of a control system. For SCADA servers, if one server can handle the site's polling and client load, N is one and N+1 means running a second server - a redundant pair - so the loss of either leaves a working system. For power, an N+1 arrangement adds one spare power supply or UPS module beyond what the equipment draws. For cooling, it adds a spare CRAC unit. For communications, it adds a backup link, which is the logic behind cellular failover: the wired path is N, the cellular modem is the plus-one that covers its loss. In each case the question is the same - how many do I need to run, and have I added one more?
Where N is larger than one, N+1 becomes noticeably cheaper than duplicating everything. Consider a set of RTUs or a bank of power supplies: if four are needed and you install five, you are paying for one extra unit to protect all four, rather than eight to fully mirror them. That efficiency is exactly why N+1 is so common. The important caveat is that N+1 only removes single points of failure among the units it covers - it does nothing about a shared dependency the whole group relies on. Five power supplies fed from one circuit are still N+1 on supplies but not on the circuit, and that shared feed is the single point of failure a higher scheme like 2N is designed to eliminate.
N+1, N+2, and 2N form a ladder of increasing protection and cost. N+1 adds one spare and survives one failure. N+2 adds two spares, so it can survive a second failure while the first is still being repaired - useful when repair times are long or the load is critical. 2N is a full duplicate of everything: two complete systems, each able to carry the entire load alone, which survives the loss of an entire system and eliminates shared single points of failure that N+1 still carries. The cost climbs accordingly, from one extra unit for N+1 up to a doubling of the whole system for 2N.
A sizing example makes the choice concrete. Suppose a control room needs 30 kW of UPS capacity and you use 10 kW modules, so N is three modules. N+1 means installing four modules: any one can fail and the remaining three still deliver 30 kW. N+2 means five modules, tolerating two simultaneous module failures. A 2N design means two entirely separate UPS systems of three modules each, on independent feeds, so an entire UPS system can be lost - not just a module - and the room stays powered. For most SCADA server and infrastructure decisions, N+1 is the sensible default; step up to N+2 or 2N only where the consequence of an outage, or the presence of shared dependencies you cannot otherwise remove, justifies the added cost. Cloud SCADA sidesteps much of this sizing work, since a platform like Merobix builds redundant capacity into the service rather than asking each customer to count units and buy spares.
N is the number of units genuinely needed to carry the full load - the working capacity required with no margin. The plus-one is a single extra unit added as a spare. So N+1 always means one more than the minimum needed, sized so that any single unit can fail and the remaining units still meet demand.
N+1 adds one spare unit beyond what is needed, so it survives a single failure at the lowest cost, but the units may still share dependencies like a common power feed. 2N is a complete duplicate of the entire system - two independent copies, each able to carry the full load alone - so it survives the loss of a whole system and removes shared single points of failure. 2N costs far more, roughly double, which is why it is reserved for the most critical systems.
It often is, provided repairs are fast and the units do not share a hidden single point of failure. N+1 protects against any one failure at a time, which covers the vast majority of real events. Step up to N+2 when repair times are long enough that a second failure could occur before the first is fixed, or to 2N when shared dependencies must be eliminated or the cost of any outage is severe.
Merobix reads your field devices into a cloud SCADA - the real thing behind these terms, live in days from any browser.