Type: explanation · Last reviewed: 2026-07-12
Applies to: Pulse Historian · edge/on-prem
A single historian is a single point of failure: if that machine dies, the plant stops recording and every dashboard and alarm goes dark. High availability (HA) removes that risk by running two historians as an active-passive pair — one Leader serves all traffic while a Secondary shadows it, ready to take over in seconds if the Leader fails. HA is optional and off by default (HA_ENABLED=true turns it on).
.bin.czst/blob cold-tier days are periodically digested (over their decompressed logical bytes) and repaired, so the two nodes cannot silently diverge on historic data.When heartbeats stop, the Secondary promotes itself to Leader, the VIP moves to it, and the singleton-gated services start there. Clients reconnect to the same VIP and resume — typically within a few seconds. The exact role state machine (Leader / SecondaryHealthy / SecondaryStale / Recovering / Promoting / Fenced) and timings are in HA architecture.
Plain delta replication can lose the handful of writes in flight at the instant the Leader dies. The optional secondary shadow cache closes that gap: clients (or the server) mirror each write to the Secondary via POST /exactapi/shadow_write, and on promotion the new Leader drains that buffer and gap-fills the writes lost during the failover window. It is disabled by default (clarity.ha.shadow_cache.* / clarity.ha.shadow_targets). See HA § Secondary Shadow Cache.
For the canonical unit boiler-2, with HA enabled and shadow cache on:
idfan_vibration through the VIP, which currently points at node A (Leader). Each write is also mirrored to node B via shadow_write.idfan_vibration series has no hole across the failover.Leader · Secondary · VIP · singleton gate · secondary shadow cache · SealedReconciler