1. What it covers
On a production line or in a campus, one edge gateway can carry dozens or hundreds of sub-devices. If it goes down, collection stops, control fails, and a safety interlock is at risk. The SimtoLink Device Management Platform treats gateway high availability as part of the whole design: hot standby on a pair, cold standby, or a small N+1 cluster. A shared virtual IP, Keepalived, a DNS health check, or a service-mesh sidecar moves northbound connections and southbound bus access onto a healthy node. What has to sync, or be rebuilt quickly, includes the sub-device mapping, metadata for the offline buffer, protocol sessions in progress, and part of the security context.
Automatic failover
Hot standby, cold standby, or an N+1 cluster. Keepalived or a DNS health check moves traffic within seconds. Northbound connections and the southbound bus follow.
Split-brain protection
A third party such as etcd or ZooKeeper, or a vote from a hardware watchdog, so during a partition only one node is writable. Two nodes do not write at once.
Chaos, then acceptance
In the lab, pull power, cut the uplink, kill the process, and fill the disk. Record how long the switch took and how many packets were lost. The acceptance report is a deliverable.
How a failover runs
What HA includes
| Capability | What it does |
|---|---|
| Heartbeat arbitration | Check the process, the network, and the service. A third-party coordinator prevents split brain |
| Virtual IP | Keepalived or a DNS health check. Gratuitous ARP moves the address within seconds |
| State sync | Sub-device mapping, offline-buffer metadata, and protocol sessions, live or rebuilt quickly |
| Chaos acceptance | Pull power, cut the network, kill the process, fill the disk. Switch time and packet loss are measured |
2. Split brain and arbitration
If a partition leaves both sides thinking they are primary, you get two writers or two controllers. Use a third party — etcd, ZooKeeper, or the cloud coordinator — or a vote over a serial link or a hardware watchdog, so only one node is writable at a time. In the architecture review, name the longest split-brain window you will accept, and what the automatic fallback is.
3. How fast the switch has to be
Production usually wants the traffic moved within seconds. Measure and tune gratuitous ARP, how fast the switch ages its MAC table, DNS TTL, and the client cache. For a long-lived session such as MQTT, connection resilience should reconnect the device to the new entry.
4. Chaos and acceptance
In the lab, pull power, cut the uplink, kill the process, and fill the disk. Record switch time, packets lost, and whether the buffer overflowed. The acceptance report is a deliverable to the owner.
5. One view on the console
The SimtoLink console shows which node is primary, the latest failover, resource use, and the history of health checks, for the NOC and for a wallboard. A failover can go out on a webhook into ITSM.
6. A runbook, and a person who can still act
Keep an approved manual switch and a rollback path, so a software fault cannot take both nodes down. The runbook should include how to restore the mapping after a spare is fitted.
7. Mesh and a second uplink
On a wireless mesh or a dual uplink, mesh fleet networking adds link redundancy. It does not remove the risk that the gateway itself is a single point of failure.
8. Summary
Gateway HA is a hard requirement in industrial IoT. It touches the network, storage, protocol state, and how operations works. SimtoLink provides a reference architecture, monitoring templates, and an acceptance checklist. Further reading: connection resilience and edge node lifecycle. For a hot-standby deployment guide, contact the SimtoLink edge delivery team.
Appendix. Failover that holds up on a live line
A failover that works on a bench still needs three habits before it protects a line. On a pre-release pair built like production, rehearse a connection storm, a full disk, certificate rotation, and a fault across regions, and keep the result as an acceptance checklist. Put switch time, alert thresholds, the on-call path, and audit retention into change management, so a VIP or a quorum change can be traced and rolled back without relying on one engineer. Each quarter, engineering, operations, security, and data should ask whether those signals still explain the risk, and attach the actions to tickets and the release calendar. The console, open API, and export on the SimtoLink Device Management Platform stay in service: observable, orchestrable, and auditable. If the pair has to meet your ITSM, IAM, data lake, or edge cluster, the SimtoLink solutions team can review the architecture with you and return an implementation note and a risk list.