Redundancy,
Priced

Redundancy is the only line in an energy project that is bought entirely on fear, priced entirely on convention, and almost never compared against the thing it is supposed to prevent. An owner who can say precisely what an hour of lost power costs will make a better redundancy decision than an owner who knows every configuration by name.

Section 01The percentage that was withdrawn seventeen years ago

Nearly every conversation about redundancy eventually produces a table of availability figures: 99.671 percent, 99.741, 99.982, 99.995, each tied to a data center tier, each converted into a tidy number of minutes of downtime per year. The figures appear in vendor decks, in consultant reports, in requests for proposal, and in the internal memos of organizations that have never built a data center and never intend to.

They are not published by the organization they are attributed to. Uptime Institute, which created the four-tier classification system and remains its custodian, states plainly that it "removed all references to 'expected downtime per year' when using the Tier Standard" in 2009.¹ The percentages that survived that removal survived in the secondary literature, not in the standard.

The second common misreading is closer to home for owners of on-site power. The Tier system is a topology standard describing outcomes, not a parts list. Uptime Institute's own description of the classification is explicit that the tiers "do not define ... specific technology options or design choices,"² and its explanatory material adds that the system "does not prescribe any specific technology, schematic or other design criteria beyond those resulting outcomes."¹ It does not require N+1. It does not require 2N. Those are engineering means of reaching a defined outcome, and they are not the only ones.

This matters because the shorthand travels. An owner asks for "Tier III" and receives a design priced around a redundancy convention imported from a different industry, sized for a different failure consequence, and justified by an availability number that its own custodian withdrew before the first iPad shipped. None of that is fraud. It is the ordinary drift of a technical vocabulary into general use. But it means that the phrase in the project brief is doing work that no engineering analysis behind it is doing.

Section 02What the configurations actually mean

Strip away the tier language and the vocabulary is simple. N is the capacity required to carry the load. Everything after it is a description of what else is installed and how it is connected.

• N — exactly enough capacity to serve the load, and no more. Any capacity outage is a load outage. Any maintenance is a load outage unless the load can be moved or shed.
• N+1 — one additional unit beyond what the load requires. The load rides through the loss of any single capacity component, including a planned one. If the load needs four units, five are installed.
• N+2 — two spare units. Bought where a second failure during the repair window of the first is judged intolerable, or where maintenance intervals are long enough that a unit is out for weeks at a time.
• 2N — two complete, independent systems, each capable of carrying the entire load. Not a spare unit, a spare plant.
• 2N+1 — two complete systems, one of which carries a spare. Rare outside facilities where the consequence of failure is measured in lives or in figures the board will not say out loud.

The distinction that owners most often miss is not between these labels. It is between capacity redundancy and path redundancy. A spare generator behind a single transfer switch, feeding a single breaker, through a single set of cables, is redundant in capacity and not redundant at all in path. The spare cannot help when the thing that fails is the wire.

This is precisely the distinction the tier system encodes. Uptime Institute describes Tier III as concurrently maintainable, with "redundant components as a key differentiator, with redundant distribution paths," such that "any part can be shut down without impacting IT operation," and Tier IV as fault tolerant, with "several independent and physically isolated systems that act as redundant capacity components and distribution paths."² Concurrent maintainability answers the question can we service it without going dark. Fault tolerance answers the question can we survive an unplanned failure without going dark. They are different questions, they cost different amounts, and a great many projects buy the first while believing they bought the second.

A spare unit behind a single transfer switch is redundant in capacity and not redundant at all in path. The spare cannot help when the thing that fails is the wire.

Section 03Redundancy adds parts, and parts fail

Every additional unit adds capacity, and also adds a machine, a fuel connection, a control interface, a breaker, a maintenance obligation, and a set of failure modes that did not exist before. The literature on real outages makes this uncomfortably concrete.

Uptime Institute's Annual Outage Analysis 2026, published May 13, 2026, reports that power remains the dominant factor in impactful outages, with failures in uninterruptible power supply systems, transfer switches, and generators particularly prominent.³ Read that list again. Those are not the loads. Those are the redundancy apparatus itself: the equipment installed specifically to prevent outages is among the equipment most implicated in causing them.

Prime movers are no more exempt. The North American Electric Reliability Corporation's 2026 State of Reliability, published June 24, 2026, reports that the weighted equivalent forced outage rate across conventional generation reached 9.2 percent in 2025, up from 7.6 percent in 2024 and above a historical norm in the 7 to 8 percent range. Coal units moved from 11.2 to 14.1 percent and combined-cycle units from 4.2 to 5.7 percent, with the deterioration distributed across most months rather than driven by a single event.⁴ These are fleet statistics for utility-scale plant under professional operation, and they are the correct order of magnitude to hold in mind when a proposal implies that a machine will be there when called.

The arithmetic that follows is the honest case for redundancy, and it is strong. Suppose a single unit fails to perform when called nine times in a hundred demand periods. Two independent units both failing in the same period, if the failures are genuinely independent, occurs roughly eight times in ten thousand. One spare converts a nine-percent problem into a sub-one-percent problem. That is an enormous return, and it is why N+1 is the default in serious facilities. These figures are illustrative arithmetic, not a prediction for any specific site or equipment.

The word carrying the entire result is independent. Two units sharing a fuel supply are not independent against a fuel interruption. Two units sharing a control system are not independent against a controls fault. Two units in the same room are not independent against a fire, a flood, or a mis-set breaker. Two units maintained by the same crew on the same schedule with the same procedure are not independent against a maintenance error, and the failure of staff to follow procedures has been a rising cause in Uptime Institute's outage work.³ Common-mode failure is not a footnote to redundancy analysis; it is the analysis. A design that spends heavily on a second unit while leaving a single shared fuel train, a single shared controller, or a single transfer point has bought the expensive half of the protection and skipped the cheap half.

Section 04Price the outage before you price the spare

Redundancy has no correct level in the abstract. It has a correct level relative to what an interruption costs the specific organization, and that number is knowable.

Two public reference points frame the question without answering it. Uptime Institute's 2026 survey found that 57 percent of respondents said their most recent major outage cost more than $100,000, and for the second consecutive year one in five put the figure above $1 million.³ The U.S. Energy Information Administration reports that the average American electricity customer experienced about 11 hours of interruption in 2024 across roughly 1.5 events, with major weather events accounting for about 80 percent of those hours.⁵ The first number describes the consequence of losing power. The second describes how often the grid, by itself, delivers that consequence.

Neither number is your number, and neither should ever appear in a business case as though it were. The organization's own figure comes from its own operations, and the components are ordinary:

• Lost production or lost revenue per hour, at the margin, not at the average, and only for hours the plant would actually have run.
• Restart cost and restart time. Many industrial processes lose far more to the ramp back than to the interruption itself. A four-second dip and a four-hour outage can cost the same if both require a full restart sequence.
• Spoilage, scrap, and rework where the process holds material in a state that degrades.
• Contractual exposure: service credits, delivery penalties, regulatory reporting obligations.
• Consequences that are not financial: safety systems, life-safety loads, environmental compliance equipment, and anything whose failure is not a cost but an incident.

That last category deserves separate treatment rather than a dollar figure, and in many buildings it is already governed by code. NFPA 110, the standard for emergency and standby power systems, classifies emergency power supply systems by Level, according to the consequence of failure, and by Type, which sets the maximum permitted time to restore power. Level 1 covers loads whose failure could result in loss of life or serious injury; Type 10 requires power restored within ten seconds.⁶ Where those obligations apply, the redundancy question for that portion of the load is not an economic optimization at all. It is a compliance requirement, and it should be separated from the discretionary analysis before the discretionary analysis begins.

Once the cost per hour is established, the comparison becomes a normal capital decision: the annualized cost of the redundant element against the expected annual cost of the interruptions it prevents, with the probability inputs stated and their sources dated. This will sometimes conclude that a spare is obviously worth buying. It will sometimes conclude the opposite. A study that always concludes in favor of more equipment is not a study.

Section 05The redundancy ladder, with the rungs that cost nothing

The configurations in Section 02 are not the whole menu. Three of the most useful options involve buying no additional generating equipment at all, and they are systematically underrepresented in documents prepared by parties who sell generating equipment.

The last three rows earn an equipment vendor nothing, which is exactly why their presence or absence in a proposal is diagnostic. The grid-as-spare row in particular is frequently the correct answer for behind-the-meter projects, and it is the row most often missing from documents written by people whose income depends on the first four.

Section 06Granularity is the variable nobody names

Here is where redundancy stops being a generic discipline and becomes a technology question, because the cost of a spare depends almost entirely on how finely the capacity divides. Adding one unit to a set of six is a modest increment. Adding one unit to a set of two is a fifty percent increase in installed plant. Two designs delivering identical capacity with identical redundancy labels can differ enormously in what that label costs.

The honest case for and against each family, on this dimension specifically:

• Reciprocating engines divide finely and cost comparatively little per unit, which makes N+1 relatively inexpensive to reach, and the service ecosystem is deep enough that repair windows tend to be short. Against: each unit is a combustion machine with its own permit exposure, noise contribution, and scheduled maintenance calendar, and a redundant set multiplies all three. More machines means more maintenance events, and maintenance events are when many failures are introduced.
• Gas turbines tend to come in larger increments, so redundancy is lumpier and the marginal spare is a larger fraction of the plant. Against the pessimistic reading: where a site has genuine thermal demand, the redundant unit is not idle capital in the same way, because heat recovery can make the spare earn during normal operation. Part-load efficiency and start behavior deserve direct scrutiny rather than assumption.
• Microturbines divide very finely, which makes graceful degradation natural and single-unit failures relatively unimportant. Against: unit count itself becomes an operations burden, and efficiency at small scale needs to be examined honestly rather than waved through on modularity alone.
• Fuel cells are modular and non-combusting, with quiet operation and, in stricter air districts, materially lighter permitting for additional units, which lowers a real barrier to adding the spare. Against: higher capital cost per unit makes the spare expensive in absolute terms, economics remain exposed to fuel price, and stack replacement is a planned outage with a real schedule that belongs in the availability model rather than in a footnote.
• Linear generators are modular and fast-starting, which suits redundant roles well. Against: as a newer equipment class, the fleet operating history that would let an owner estimate forced outage rates with confidence is thinner, and the honest response is to ask for the data and weigh it, not to assume either the best or the worst.
• Solar with storage has no forced outage rate in the conventional sense, since there is no prime mover to fail, and inverter-level redundancy is comparatively cheap. Against: its availability is set by resource and duration rather than by mechanical reliability, so for a continuous load it is a different kind of asset than a spare machine, and calling it redundancy without stating the duration is a category error.
• The utility service is the only spare with no capital cost at all where it already exists. Against: it fails too, at rates the site can measure from its own history, and retaining it carries standby and departing-load charges that must be priced into the comparison from the beginning.

Every one of those entries cuts both ways. A redundancy section that reads as an argument for a single equipment family was written to sell that family.

Section 07Seven questions to ask about any redundancy proposal

These can be run on any design document in under an hour, by a finance committee with no engineering background. They are as binding on our work as on anyone else's.

1. What does one hour without power cost this organization, in writing?If the redundancy scheme was designed before that number existed, it was designed against a convention rather than against a consequence.
2. Is the redundancy in the capacity, in the distribution path, or in both?Ask which single component, if it failed, would still take the load down. If the answer is a transfer switch, a breaker, or a cable, the spare unit is not buying what the brief says it buys.
3. What do the two units share?Fuel, controls, room, crew, procedure, spare-parts pool. Every shared element is a path around the redundancy. The design should list them explicitly and say why each is acceptable.
4. Where did the forced outage rate come from?A published fleet statistic, an operator's own record, or an assumption. All three are legitimate inputs; only the third is legitimate when labeled.
5. How long is the repair window, honestly?N+1 protects for the duration of a repair. If a critical part has a long lead time, the analysis needs the lead time in it, not an assumed prompt replacement.
6. Were grid-as-spare, storage-as-bridge, and load-shed priced alongside the extra machine?Three options that pay an equipment vendor nothing. Their absence tells you what kind of document you are holding.
7. Which loads are governed by code rather than by economics?Life-safety and compliance loads under standards such as NFPA 110 are not part of the optimization. Separate them first, then optimize what remains.

Section 08What a study should say about redundancy

A defensible treatment of the redundancy question, whoever prepares it, contains the same elements:

• A stated cost of interruption built from the owner's own operations, with the components shown and the estimates labeled as estimates.
• A separation of code-driven loads from discretionary loads, with the governing standard named, before any optimization runs.
• A common-mode inventory: every element the redundant units share, and a stated judgment on each.
• Availability inputs with sources and dates, distinguishing published fleet statistics from site-specific history and from assumptions.
• The full ladder priced, including grid-as-spare, storage-as-bridge, and load-shed, and including the option of buying no redundancy at all.
• Sensitivity on the inputs that flip the answer, which in our experience are usually the cost per hour of interruption and the repair window, not the equipment reliability figure everyone argues about.
• A recommendation with its conditions attached: what would have to change for the answer to change, stated plainly enough that the owner can watch for it.

Redundancy is the part of an energy project where owners are most likely to be told what everyone does and least likely to be told what their own situation requires. The two are related only by coincidence. A configuration that is standard practice in one industry, imported into another with a withdrawn availability figure attached, is not an engineering conclusion. It is a habit with a decimal point.

Our position is the same here as everywhere in this series: price all the paths, source and date every number, label every estimate, and let the answer be whatever it turns out to be, including the answer that the spare is not worth buying.