Why redundant SCADA servers aren't automatically interchangeable backup strategies — "we have a backup" is not one fact, it's a spectrum.
Ask whether a SCADA system has a redundant server and the answer is usually just "yes." That single word hides one of the most consequential design decisions in the whole architecture: is that backup server fully powered on, continuously synchronized, and ready to take over in a heartbeat — or is it sitting idle, waiting to be started up and brought current only after something has already gone wrong? Those are two fundamentally different promises, and mistaking one for the other is exactly how a "protected" system turns out to have a real, unplanned gap in coverage the day it actually needed to fail over.