PI Adapter High Availability Resilience

Problem Summary:

The client failover service for PI adapter is not highly available. If the client failover service node is unavailable, then the PI adapter instances that it manages will lose failover functionality. This is further exacerbated if the primary PI adapter node goes down as well. In this case the secondary PI adapter will stay in its last current state of backup until human intervention (role override on the secondary PI adapter node).

Solution:

Client failover service does not need to be redundant if the PI adapter pairs that it manages are smart enough to communicate with each other in the case the failover service goes down. In the unique case of the primary PI adapter and client failover service becoming unavailable, then the secondary will automatically take over.

This potential solution allows for self-healing without human intervention at remote sites.

Below is a potential workaround (not tested). If it works, then we would like to see it incorporated into PI adapters.

1. Client failover service goes down.

2. primary PI adapter goes down.

3. secondary is in a backup state.

4. outside service/script hosted on secondary periodically checks the health of the primary, and client failover service (this can be a simple ping).

5. if both primary, and Client failover service are down, then the secondary assumes primary state with a role override command:

   1. https://docs.aveva.com/bundle/client-failover-service/page/administration/perform-a-role-override.html