Graceful primary shutdown triggers failover

A graceful shutdown performs the following operations:

1. IF-Node1 stops.

2. At exit, the IF-Node1 writes a value of 0 to its heartbeat point and active ID point.

3. IF-Node2 reads the active ID point, detects the 0 value, and assumes the role of primary.

In some cases, IF-Node1 stops shortly after IF-Node2 checks the value of the failover control points. When this happens, IF-Node2 will not recognize that IF-Node1 has shut down for an additional failover update interval. This does not result in data loss for hot failover configurations because the backup queues data for two failover intervals and any additional time where the primary status was unknown. When IF-Node2 assumes the primary role, it sends queued data to Data Archive. This results in overlapping data for one or two failover update intervals.

When IF-Node2 assumes the role of primary interface, it performs the following operations:

4. IF-Node2 writes its failover ID to the active ID point.

5. IF-Node2 waits for two failover update intervals, then verifies that the active ID value is the same as its failover ID. Depending on the verification result, IF-Node2 performs the following actions:

   • If the active ID is equal to the failover ID for IF-Node1, IF-Node2 remains in the backup role.

   • If the active ID is the same as the failover ID for IF-Node2, IF-Node2 assumes the primary interface role and sends queued data to Data Archive.