TL;DR
A high-availability edge AI system keeps inference running when one component dies. The pattern is an active node and a standby node fed by the same cameras and sensors, joined by a managed switch running a self-healing ring so a cut cable recovers in milliseconds. This guide walks a reference design built on two Nuvo-11000 compute nodes, a compact Nuvo-11531 warm spare, and a PLANET IGS-6325-16P4S ring switch, then covers component choice, build steps, and a validation plan.
Overview
Most edge AI outages are not model problems. They are a dead SSD, a dropped Ethernet link, a sagging power rail, or a node that hangs at 3 a.m. with nobody on site. On a production line or in a substation, one stalled inference box can halt output or leave an operator blind to a fault. Redundancy buys time. The system degrades instead of stopping, and a technician swaps the failed part on the next shift rather than the next flight.
This is more an architecture problem than a hardware problem. Picking the right box matters, and our guide to choosing an industrial edge AI computer walks through that. Availability, though, comes from how the boxes, network, storage, and power are wired together, and from how failover gets triggered and tested. Once a pair is live you still need to watch it and push updates without a site visit, which we covered in remote management of edge AI fleets. Locking the design down against tampering is the other half of reliability; see our write-up on IEC 62443 for industrial computers.
Reference architecture
The design pairs an active node with a standby and removes single points of failure one layer at a time.
| Layer | Element | Redundant design | Failover mechanism |
|---|---|---|---|
| Compute | Inference nodes | Active Nuvo-11000, warm-standby Nuvo-11531 | Heartbeat on a dedicated link; standby promotes on missed beats |
| Network | Field switch | Managed switch closed in a ring | ITU-T G.8032 ERPS recovers the ring in about 10 ms |
| Storage | OS and model store | Mirrored NVMe (RAID 1) in each node | A drive drops, the node runs on its mirror |
| Power | DC input | Two feeds, wide-range input | Second feed carries the node if one rail sags |
| Data | Camera and sensor feeds | Both nodes subscribe to the same streams | Standby holds warm state, so no cold start |
Component selection
The Nuvo-11000 carries the primary workload. It runs an Intel Core Ultra 200S processor, is fanless, takes a wide-range DC input with optional ignition control, and is built to MIL-STD-810H, so it survives the vibration and temperature swings that kill consumer hardware first.
The standby does not have to match the primary watt for watt. It only has to run the same model and runtime. The Nuvo-11531 fits that role at a 212 by 165 by 63 mm footprint, with four PoE+ 2.5GbE ports to take camera feeds directly and up to 36 TOPS from its NPU and integrated GPU. That covers most rule-based vision and light inference while the primary is out.
The network is where a lot of "reliable" designs quietly fail. A single switch with a single uplink is one backhoe away from an outage. The PLANET IGS-6325-16P4S is a Layer 3 managed switch with 16 PoE+ ports, a 360 W budget, four 2.5G SFP slots, and redundant power input. Closed into a ring, its ITU-T G.8032 ERPS logic restores traffic in roughly 10 ms after a link cut, fast enough that a running inference stream barely notices.
Implementation steps
- Cable both nodes to the switch and close the ring through a second switch or a return fiber, then enable G.8032 ERPS.
- Feed each node from two separate DC supplies and set the power-good or ignition thresholds.
- Mirror the OS and model store on each node with RAID 1 NVMe.
- Run a heartbeat between the pair on a dedicated link and define the promotion rule, for example three missed beats at 200 ms.
- Point both nodes at the same camera and sensor streams so the standby keeps warm state.
- Wire the alarms. Route the switch digital output and each node watchdog into your SCADA or monitoring stack.
Validation
A redundant system you never test is just a more expensive single point of failure. Run these before sign-off, then on a schedule.
| Test | Method | Pass criterion |
|---|---|---|
| Ring recovery | Cut one ring link | Traffic restored, measured under 50 ms |
| Storage loss | Remove one NVMe mirror | Node keeps running, alarm raised |
Log the recovery time for each test. Numbers on paper are how you prove the design to an auditor or a plant manager, and how you catch a config drift six months later.
Related Products
Conclusion
High availability at the edge is not one expensive box. It is a pair of honest ones, a network that heals itself, mirrored storage, dual power, and a test plan you actually run. Build it that way and a failure becomes a work order instead of a phone call at midnight. Follow Neteon on LinkedIn for more deep dives, or reach us at [email protected] or www.neteon.net to scope a redundant edge AI pilot.
FAQs
What does high availability mean for an edge AI system?
It means inference keeps running when a single part fails. A failed drive, link, or node degrades the system instead of stopping it, so a technician can replace the part on the next shift rather than during an outage.
Do the two nodes have to be identical?
No. An active node and a standby can differ in size and power as long as they run the same model and runtime. A Nuvo-11000 primary paired with a compact Nuvo-11531 spare is a common split.
How fast can a redundant network ring recover?
With ITU-T G.8032 ERPS on a managed switch like the PLANET IGS-6325-16P4S, a simple ring restores traffic in roughly 10 ms after a link cut, fast enough that a running inference stream barely notices.
Is RAID enough for availability?
RAID protects against a drive failure inside one node, not against the node itself dying. Mirror the storage and add a standby node so both failure modes are covered.
How do I know failover actually works?
Test it. Pull power on the active node, cut a ring link, and drop a DC feed on a schedule, then log the recovery time each run so you catch config drift before it bites.
