# Module controlling redundancy failover

**URL:** <https://forum.inductiveautomation.com/t/module-controlling-redundancy-failover/115921>\
**Category:** Module Development\
**Tags:** ignition81\
**Created:** [June 10, 2026, 8:21am UTC](https://forum.inductiveautomation.com/t/module-controlling-redundancy-failover/115921 "2026-06-10T08:21:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thomas\_Mulcahy](https://avatars.discourse-cdn.com/v4/letter/t/f1d935/32.png) [@Thomas\_Mulcahy](https://forum.inductiveautomation.com/u/Thomas_Mulcahy)\
**Post date:** [June 10, 2026, 8:21am UTC](https://forum.inductiveautomation.com/t/module-controlling-redundancy-failover/115921/1 "2026-06-10T08:21:06Z")

</div>

Hello,

I currently have a module that does some processing in addition to standard Ignition.

I need to add redundancy support to the module, but one thing I am stuck on is. Once the backup gateway takes over from the master in a failover situation my module on the backup takes over the processing, which works correctly.

What I want to do is, once the master gateway is available again I want to delay moving back to master until my backup module has finished the processing it is doing, then the master can restart processing again.

This is to prevent effectively 2 modules writing the database during the short time they are moving from one to the other and to prevent confusion between the 2 modules.

I can't see a way of doing this, so I am not sure it is possible to control from a module. I am mainly dealing with the RedundancyManger class.

Any help is appreciated.

Thanks

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [June 10, 2026, 11:44am UTC](https://forum.inductiveautomation.com/t/module-controlling-redundancy-failover/115921/2 "2026-06-10T11:44:43Z")

</div>

Unlike Ignition's jython infrastructure, your java code execution is not cut off on the inactive member of a redundant pair. So you can keep processing on the inactive node, but you will then be responsible for handling all of the error cases. In particular, what should your master do when the reason it becomes active is loss of the previously active backup?

And should the master finish processing on controlled fail-overs to the backup? (Symmetry to simplify code.)

I recommend you treat the gaining of active status like a fresh startup, in either direction, and have your module examine its DB storage to figure out what needs to be done to get started.

---

<div class="post-metadata">

**Author:** ![mgross](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mgross/32/3311_2.png) [@mgross](https://forum.inductiveautomation.com/u/mgross)\
**Post date:** [June 10, 2026, 2:57pm UTC](https://forum.inductiveautomation.com/t/module-controlling-redundancy-failover/115921/3 "2026-06-10T14:57:25Z")

</div>

One thing that is problematic about trying to do work on the inactive redundant node is that there is no easy way to monitor what is going on. Perspective sessions and Vision clients don't work so you can't use those. You can set up the master gateway to remain inactive after it comes back online and connects to the active backup. Then you have full control over when the master gateway becomes active. But then you have to deal with telling the backup to wrap up its database work to prepare for a manual failover back to the master. The backup is still active at this point, so at least you can send commands via a Perspective session or Vision client. You can also initiate the failover back to the master via the RedundancyManager, like so:

```python
RedundancyManager rm = gatewayContext.getRedundancyManager();
ActivityLevel toRequest = rm.getCurrentState().getActivityLevel() == ActivityLevel.Active ? ActivityLevel.Active
            : ActivityLevel.Cold;

rm.requestPeerActivityLevel(toRequest);

```

Maybe you can combine the wrap-up-database-work and failover actions in your module?

---

<div class="post-metadata">

**Author:** ![Thomas\_Mulcahy](https://avatars.discourse-cdn.com/v4/letter/t/f1d935/32.png) [@Thomas\_Mulcahy](https://forum.inductiveautomation.com/u/Thomas_Mulcahy)\
**Post date:** [June 10, 2026, 3:30pm UTC](https://forum.inductiveautomation.com/t/module-controlling-redundancy-failover/115921/4 "2026-06-10T15:30:45Z")

</div>

I think this is sort of what I was looking for.

I can set the master to "manual" and ask it to pass back control once the backup gateway is finished. That way I can do what Phil said, and interrogate the database to find out where to start from again.

Thanks!

---

<div class="post-metadata">

**Author:** ![Thomas\_Mulcahy](https://avatars.discourse-cdn.com/v4/letter/t/f1d935/32.png) [@Thomas\_Mulcahy](https://forum.inductiveautomation.com/u/Thomas_Mulcahy)\
**Post date:** [June 11, 2026, 11:09am UTC](https://forum.inductiveautomation.com/t/module-controlling-redundancy-failover/115921/5 "2026-06-11T11:09:02Z")

</div>

Just to note @mgross I tested this, and it works great. Thanks!