From the Hadoop : The Definitive Guide, I believe this is easily understandable and pretty straight forward.
Failover and fencing
The transition from the active namenode to the standby is managed by a
new entity in the system called the failover controller. Failover
controllers are pluggable, but the first implementation uses ZooKeeper
to ensure that only one namenode is active. Each namenode runs a
lightweight failover controller process whose job it is to monitor its
namenode for failures (using a simple heartbeating mechanism) and
trigger a failover should a namenode fail.
Failover may also be initiated manually by an adminstrator, in the
case of routine maintenance, for example. This is known as a graceful
failover, since the failover controller arranges an orderly
transition for both namenodes to switch roles.
In the case of an
ungraceful failover, however, it is impossible to be sure that the
failed namenode has stopped running. For example, a slow network or a
network partition can trigger a failover transition, even though the
previously active namenode is still running, and thinks it is still
the active namenode. The HA implementation goes to great lengths to
ensure that the previously active namenode is prevented from doing any
damage and causing corruption—a method known as fencing. The system
employs a range of fencing mechanisms, including killing the
namenode’s process, revoking its access to the shared storage
directory (typically by using a vendor-specific NFS com- mand), and
disabling its network port via a remote management command. As a last
resort, the previously active namenode can be fenced with a technique
rather graphi- cally known as STONITH, or “shoot the other node in the
head”, which uses a speci- alized power distribution unit to forcibly
power down the host machine.
Client failover is handled transparently by the client library. The
simplest implemen- tation uses client-side configuration to control
failover. The HDFS URI uses a logical hostname which is mapped to a
pair of namenode addresses (in the configuration file), and the client
library tries each namenode address until the operation succeeds.
Hope it helps!