---
name: high-availability
description: >-
  CI Server R1.05 high availability with HAC (redundant servers). Use when the user asks about
  redundant / dual / triple / quad servers, primary and secondary server, active and standby,
  switchover (automatic or manual), the HAC HMI (hacw_hmi), watchdog, recovery (restart a
  process or tool, hacrec, -wdg_off), mirror / synchronization of the standby, journaling and
  key file repair (isfjrn, *.jrn), history merge after an island situation (hachmfcmd), hac.sup,
  CI_PRIM, hacw_standby / hacw_stop scripts, extension scripts run on activate / deactivate
  (?*_hacw_activate.cmd), HAC status items (SYSTEM.HAC1), hacitmval, HAC firewall ports
  (UDP 16000-16006, HMI 16010-16041), hardware watchdog or custom health checks, or applying a
  patch to a redundant system. Source IM 36K10J20-01EN.
---

# High availability — HAC (R1.05)

Re-checked for R1.05 on 2026-10-09 (read-only, file and manual comparison only). The manual
(4th Edition, Feb. 2026) is unchanged apart from contact information; `hac.sup`, its template
and most HAC scripts are identical to R1.03. New on R1.05: `hacw_activate`/`hacw_deactivate`
call extension scripts `?*_hacw_activate.cmd`/`?*_hacw_deactivate.cmd` (ISS-160), and
`hacw_hmi` needs the `tls\exe\lib` folder (ISS-161). The R1.05 test server is a single,
non-redundant server without a HAC licence, so **all HAC behaviour is not tested on R1.05**.

Background: `knowledge/manuals/IM36K10J20-01EN.md` (concepts, processes, set-up steps,
installed `hac.sup` and the differences from the manual).

Rules:
- Run `system-check` first; follow the user's chosen way of working. Use the `TLS_*`
  variables for paths (the install root differs between systems).
- HAC needs its own licence and at least two servers with two separate networks between them.
  Nothing here was practiced on a real redundant pair (R1.03 or R1.05): say so when giving
  procedures.
- `hac.sup`, the `tls\com` scripts and system variables need admin rights and a restart; hand
  them to the user (skill `portal-setup`, `change-setup-file.md`).
- Never switch over, reboot or change a server's mode on a running plant without the user's
  explicit approval, and only when the mirror is consistent (see `redundant-setup.md` §3).
- Do not start `hacrec` with `-wdg_off` on a server without reviewing its process list first:
  stand-alone Recovery acts (default action for most processes is `TOOL` = restart services).
- Do not run `hac*` tools on a system just to "look": even status commands talk to the HAC
  processes. Read files and logs instead (`hac-checks.md`).
- Before recommending a design, check the release notes (IM 36K01A50): no mix of physical and
  virtual machines in one HAC configuration (§1.19); after a HAC network-card switch, OPC UA
  PubSub writers must be uploaded again (§1.15, R1.04 and later; ISS-162).

| Task | File | Status |
|---|---|---|
| Check HAC on a system: licence, processes, `hac.sup`, scripts, HMI properties, logs | `tasks/hac-checks.md` | verified read-only on R1.03 (2026-10-01) and on the R1.05 test server (2026-10-09; single server, HAC not used) |
| Set up and operate a redundant server pair: steps, `hac.sup` tabs, manual switchover, patching | `tasks/redundant-setup.md` | from docs; not tested on R1.03 or R1.05 (no redundant pair); installed files compared on R1.05 |
| Recovery, logger and journaling on a stand-alone node | `tasks/standalone-recovery.md` | from docs; not tested (starting Recovery would act on the shared R1.05 test server); installed files compared on R1.05 |
| Dual-redundant Platform for Computer | — | not covered (separate product; precautions in the A50 summary §1.1) |